5c63c077b19b3b6de7977ce87589fd0720a82a26370c49e8e9756c383279a459 | Triage

Analysis

max time kernel
173s
max time network
221s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 17:24

Sharing

Report Analysis Logs

General

Target

30ae4efe0bf3468816b2a390416cc6b6.dll
Size

6KB
MD5

30ae4efe0bf3468816b2a390416cc6b6
SHA1

5cabdd450f0ef94bcefb3fd7a315686d20caa231
SHA256

5c63c077b19b3b6de7977ce87589fd0720a82a26370c49e8e9756c383279a459
SHA512

99bae5410f6af41647c09fd9b131ff16a1e7f9afc48cff1d83835f7e1f868d8c51d3995071f78bc0241ed848cb94ec03be8e88877f4ce7226b6e64d1c6a31182
SSDEEP

48:6WQV5YVOqtV0H1pw9ygYVUG0VB+BDq9J5SC:8qtV0HAr4oB+FqX5SC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 2072	644	rundll32.exe	87
PID 644 wrote to memory of 2072	644	rundll32.exe	87
PID 644 wrote to memory of 2072	644	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\30ae4efe0bf3468816b2a390416cc6b6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\30ae4efe0bf3468816b2a390416cc6b6.dll,#1
  2⤵
  PID:2072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads