75eb915a12e71d7ced08489942421c580fbe3a9f3ad5e553673b7b4855077cb0 | Triage

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 18:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3351d6b186714a13fb275acce04ae9ff.dll
Size

284KB
MD5

3351d6b186714a13fb275acce04ae9ff
SHA1

aa21aafb13f05e3247ca09f4936256be6a2185f6
SHA256

75eb915a12e71d7ced08489942421c580fbe3a9f3ad5e553673b7b4855077cb0
SHA512

564bf62916e8d2d79ae0eba35a999ebc87b6f19ad52f163c3609dbe840c081d22e330e129fdbe7eca9f59c972c8c3d18ad4a2e7ed3368c2ef3b3c772d9e9a344
SSDEEP

3072:ZMenrtT0sOmIPd5B9fi9UH4Rni5gYFgmpSKKugtbjpASp:Z5zOm2lz/Fg+ajp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 4596	3056	rundll32.exe	87
PID 3056 wrote to memory of 4596	3056	rundll32.exe	87
PID 3056 wrote to memory of 4596	3056	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3351d6b186714a13fb275acce04ae9ff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3351d6b186714a13fb275acce04ae9ff.dll,#1
  2⤵
  PID:4596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads