a7e7e8ce433befdc8e1ba56d7c2a83c2e10ac9d8619cfcf4e49dc6e47e4d9b4d | Triage

Analysis

max time kernel
186s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 17:26

Sharing

Report Analysis Logs

General

Target

30c4ce1dd78397851c2c4e81808f1d8f.dll
Size

6KB
MD5

30c4ce1dd78397851c2c4e81808f1d8f
SHA1

bfebf758da7d418aa1db4609dda201a1291296cf
SHA256

a7e7e8ce433befdc8e1ba56d7c2a83c2e10ac9d8619cfcf4e49dc6e47e4d9b4d
SHA512

9980397811228ce5713a938962b8d61d9d2394e772dc2d5d24031076ae97af4cc4600ccb535f470ba646eee3bb21d7d159b1a79c2046657fe1d27a79389d7a1d
SSDEEP

48:6AA35YVOQDV8FszwydlAYsLFV3G0sJB+BDq9J5S2:0QDV8FscMjsLFV3UJB+FqX5S2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 3628	3088	rundll32.exe	87
PID 3088 wrote to memory of 3628	3088	rundll32.exe	87
PID 3088 wrote to memory of 3628	3088	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\30c4ce1dd78397851c2c4e81808f1d8f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\30c4ce1dd78397851c2c4e81808f1d8f.dll,#1
  2⤵
  PID:3628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads