47d5028ca7e4320c9242d280c12cb6355aa2c216878376b9b18d7493466d8da7 | Triage

Analysis

max time kernel
139s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 04:55

Sharing

Report Analysis Logs

General

Target

55ec671d16161867804cb96fdd76d720.dll
Size

263KB
MD5

55ec671d16161867804cb96fdd76d720
SHA1

229a4db35a95ec859d470f24093f0d0e23d41fd6
SHA256

47d5028ca7e4320c9242d280c12cb6355aa2c216878376b9b18d7493466d8da7
SHA512

1af649354f438ec2344ceeff6a5d799b5df53c5045b9436bd77311a82093f44697a878f852928e0d25d7df67e7762f37fe8584535642d48a0d684daca71bba48
SSDEEP

6144:1yN1x7yWlN2xjqH39JMEDQEh1UAvdPLM8:1yLxxHXLjdP48

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1380	1824	rundll32.exe	89
PID 1824 wrote to memory of 1380	1824	rundll32.exe	89
PID 1824 wrote to memory of 1380	1824	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55ec671d16161867804cb96fdd76d720.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\55ec671d16161867804cb96fdd76d720.dll,#1
  2⤵
  PID:1380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads