817da7947c07e184279e408939c8aeb3b34884bd53419e46f6fa08d635ea57f2 | Triage

Analysis

max time kernel
138s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 17:16

Sharing

Report Analysis Logs

General

Target

30313341dc21b9ccf67599511bdb0e4f.dll
Size

6KB
MD5

30313341dc21b9ccf67599511bdb0e4f
SHA1

dcece05abc402ab784fa5e14ca83260f51306971
SHA256

817da7947c07e184279e408939c8aeb3b34884bd53419e46f6fa08d635ea57f2
SHA512

f45b5909a854fd29d8863006d1eec82bc899f53e5fdc1b71c2631dab5aee6f55d6a98bfdb610823e42c004c057e60fb341d0182cec369380ab8dd4b820b029fa
SSDEEP

48:6WQV5YVOqtV0H1pw9ygYVUG0TB+BDq9J5SC:8qtV0HAr4KB+FqX5SC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 4968	4692	rundll32.exe	45
PID 4692 wrote to memory of 4968	4692	rundll32.exe	45
PID 4692 wrote to memory of 4968	4692	rundll32.exe	45

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\30313341dc21b9ccf67599511bdb0e4f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\30313341dc21b9ccf67599511bdb0e4f.dll,#1
  2⤵
  PID:4968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads