6413c4038459e4774730ed5b21b8514de2edb0c9333e78ddad2c6488257a21ae | Triage

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 16:22

Sharing

Report Analysis Logs

General

Target

2cc4a11bbdd927a9527770606bec7382.dll
Size

40KB
MD5

2cc4a11bbdd927a9527770606bec7382
SHA1

0b5b50ae0ff1320aec227c29a5de8ea9429561c1
SHA256

6413c4038459e4774730ed5b21b8514de2edb0c9333e78ddad2c6488257a21ae
SHA512

c438140017587114b017a94a2fcab13613214d68b1fa029616e1707192eecb0fc13b4203a2ee5dc65526d51ae544dd392f000eeeee45f4c8116626df655ac4e8
SSDEEP

768:6IJaggKhUHTn0TOXzqW0UBBQARQk3hlA/MxZF:Dagg4CM2uW0UBBQARhkU

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 4556	4708	rundll32.exe	36
PID 4708 wrote to memory of 4556	4708	rundll32.exe	36
PID 4708 wrote to memory of 4556	4708	rundll32.exe	36

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cc4a11bbdd927a9527770606bec7382.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cc4a11bbdd927a9527770606bec7382.dll,#1
  2⤵
  PID:4556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads