e5fec250b258d34afd73468e368e496dd63b42c1afdb4b51578aa98d343b7a94 | Triage

Analysis

max time kernel
156s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 11:09

Sharing

Report Analysis Logs

General

Target

_Setup.dll
Size

324KB
MD5

200bede8248e5b0b238b8d2c89b92aaf
SHA1

916a9d3bbf46a808dec38e66b059e21edd9f8fb5
SHA256

0f5f4e003f4666ddc29a6cdd640a7d3b59687de1ccc54ad0dd30f1b701d7eb6a
SHA512

6797d64b2f4601b74b7b52e130fae7a83c0cd85654bf3de6bb41ce3f08425cc9688e6b3075510147a97e100939ee899bf6fbddc7e86f533fdd8f098369be5632
SSDEEP

3072:Nb9YfMX0E9QsJB9cWe7Ka2coNfCp5CKjGdwizJQpAPbK8nIi0nn4QfnmwfVCD4rT:NKlua8NfCp5C9dwE5X0zCGn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 5116	4516	rundll32.exe	88
PID 4516 wrote to memory of 5116	4516	rundll32.exe	88
PID 4516 wrote to memory of 5116	4516	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_Setup.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\_Setup.dll,#1
  2⤵
  PID:5116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads