eabb567d402c51623e0563016748fdb1b8d701b6bcb0509eb65f8aa05d694162 | Triage

Analysis

max time kernel
136s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 12:23

Sharing

Report Analysis Logs

General

Target

Lenin_Script/dll/findfile.dll
Size

20KB
MD5

7c8d4f4d3bdbd35453080088d5ed835f
SHA1

365d40eababe1012d4b06e883bb34420024b9142
SHA256

f36950152f68f871b8a6a89ad38ec17b5fc4d62778ca3c69513df9ce15bb3f81
SHA512

6c11d36c162cadde393571d2a494b97ce6e99681ad516329ba54ddb5c98fae68fd5f34c2792147fc8b2055d9d13fa4901fc79e3078168d8f59dd6a38f335adde
SSDEEP

384:Afo0liOTmsFhQFivKUb0v5cumlkjyVavuopo5/d:QiOTmEjCUb0vdtvbpo5/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2980	1668	rundll32.exe	89
PID 1668 wrote to memory of 2980	1668	rundll32.exe	89
PID 1668 wrote to memory of 2980	1668	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Lenin_Script\dll\findfile.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Lenin_Script\dll\findfile.dll,#1
  2⤵
  PID:2980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads