a0d36f0047f58a8df7f259f03fb1fb1cee6872f9050d7d06335afca53b2522c1 | Triage

Analysis

max time kernel
91s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 17:13

Sharing

Report Analysis Logs

General

Target

3001be588e91bd2961c6624515be8c8b.dll
Size

102KB
MD5

3001be588e91bd2961c6624515be8c8b
SHA1

86ba7a8bd169c2f5076651fa3d58901c51b59a8b
SHA256

a0d36f0047f58a8df7f259f03fb1fb1cee6872f9050d7d06335afca53b2522c1
SHA512

b1dbd6b717b04ebde8d5286b310fc82ba14bd757552f9ca3db95a80c5ae3430bc0d9600f5601b974f133075870e4ab31a852a7e95aa83433e90c118d98bf41be
SSDEEP

1536:8+NQVimdYXz3AaEJw5w1pZcP4xgadSrRWYL4Hw:lNQL6Dngw5w1jcAxqWYL5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 1396	4996	rundll32.exe	90
PID 4996 wrote to memory of 1396	4996	rundll32.exe	90
PID 4996 wrote to memory of 1396	4996	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3001be588e91bd2961c6624515be8c8b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3001be588e91bd2961c6624515be8c8b.dll,#1
  2⤵
  PID:1396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1396-0-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download