21e499485295235330b864c784c869416b7c28022f24994e46dc284b22df175e | Triage

Analysis

max time kernel
147s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 16:15

Sharing

Report Analysis Logs

General

Target

2c4cf1648e1ef8b85031a566a7796cd9.dll
Size

500KB
MD5

2c4cf1648e1ef8b85031a566a7796cd9
SHA1

199c0e9af5d0b71f6ed6a4afd8d72b94a5e50bc1
SHA256

21e499485295235330b864c784c869416b7c28022f24994e46dc284b22df175e
SHA512

85694d124f4efd59f654064cf48ec7111ba7cc6ab93966da36144d6bd242f1dd09cbd8b04d1c0407ab14224d8c58e35112759b197db4eaa78f03cd15cee677f1
SSDEEP

12288:MBjZqL9hDvCnWmKGu14R6Gy8Gj82tRgN3:M6CWmKhyZ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 516 wrote to memory of 4708	516	rundll32.exe	65
PID 516 wrote to memory of 4708	516	rundll32.exe	65
PID 516 wrote to memory of 4708	516	rundll32.exe	65

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c4cf1648e1ef8b85031a566a7796cd9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c4cf1648e1ef8b85031a566a7796cd9.dll,#1
  2⤵
  PID:4708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads