13ceb7b032fbce097558d1de7bb15370b889601ffcd878a2f5605cd94224bda1 | Triage

Analysis

max time kernel
139s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2e953065225d5764a5e977d9429cf13b.dll
Size

432KB
MD5

2e953065225d5764a5e977d9429cf13b
SHA1

c776056dd0d3f373fe6246697ac28ec7e7c2fa18
SHA256

13ceb7b032fbce097558d1de7bb15370b889601ffcd878a2f5605cd94224bda1
SHA512

72faaa8136ef57d91545b034df87062ea597344aaec7e4538d4c7c3a48d3256e6fbc424618a7d69a272f5f3c14f34185728bd36f726bb6349022f04e57bd906a
SSDEEP

12288:WUKHtQz/hSNSKle3WR57fL4IUlfxCftm483:W0hA4RCfQ40

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2028	1872	rundll32.exe	89
PID 1872 wrote to memory of 2028	1872	rundll32.exe	89
PID 1872 wrote to memory of 2028	1872	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e953065225d5764a5e977d9429cf13b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e953065225d5764a5e977d9429cf13b.dll,#1
  2⤵
  PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads