21c3af6a300d106b3826c4a654eb4cfd32ea5de0c72a99b63f2e57ada1137240 | Triage

Analysis

max time kernel
123s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 07:40

Sharing

Report Analysis Logs

General

Target

0f85cfa3e364a9b9705c014ab00bef4e.dll
Size

840KB
MD5

0f85cfa3e364a9b9705c014ab00bef4e
SHA1

3c548a77f59cb2089b27ca1be6a43f8af481079b
SHA256

21c3af6a300d106b3826c4a654eb4cfd32ea5de0c72a99b63f2e57ada1137240
SHA512

63302e084b73dbed19d12b5f611c65fd0fd6d29f3fabaa644da90ce9e4abbf3fe3c27e0282db5215fe43248f2680751bde83b98e1135fbcec5465e333ac950c8
SSDEEP

24576:bdKYR5ISWr6VLkR65+pFEikuLCurzHDz61:JKYnICwRBFxtvDW1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 2008	4928	rundll32.exe	17
PID 4928 wrote to memory of 2008	4928	rundll32.exe	17
PID 4928 wrote to memory of 2008	4928	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f85cfa3e364a9b9705c014ab00bef4e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f85cfa3e364a9b9705c014ab00bef4e.dll,#1
  2⤵
  PID:2008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads