eabb567d402c51623e0563016748fdb1b8d701b6bcb0509eb65f8aa05d694162 | Triage

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 12:23

Sharing

Report Analysis Logs

General

Target

Lenin_Script/dll/color.dll
Size

3KB
MD5

d97dcf39eb9862d972501e58bd6c2b6b
SHA1

ea9ba2a232132d8be7920fff24549afc5196282c
SHA256

f02e921771b819376cf368436b7f581ef459fe95b6a4aa2e20a78e5fed04c836
SHA512

a7b7654558b0596d6c7824049da828e5aca3bea0d5766ecdbadf31f1df8f84c7f894a77e63269b91f238b3ca1cd9bc415cfc11ba74e393fc70972edf71ade911

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 3140	844	rundll32.exe	89
PID 844 wrote to memory of 3140	844	rundll32.exe	89
PID 844 wrote to memory of 3140	844	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Lenin_Script\dll\color.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Lenin_Script\dll\color.dll,#1
  2⤵
  PID:3140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads