a73397c75602afbd9382b66b126fd712438bb2530f7bb56d5addcb7e30a712df | Triage

Analysis

max time kernel
95s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 06:07

Sharing

Report Analysis Logs

General

Target

58a0949714ee508b77a5e3194b375379.dll
Size

6KB
MD5

58a0949714ee508b77a5e3194b375379
SHA1

a6f091d3e434b4c78b254e00cb4ca1576fc0cab8
SHA256

a73397c75602afbd9382b66b126fd712438bb2530f7bb56d5addcb7e30a712df
SHA512

81c3b8fba31ea800fc3374abce97c353485ab19d8aef1bca260566b8ac093ca65493d1c768363066a20513251cb1d4d864f1e2d879b51fa2f4f2faf1b1194552
SSDEEP

48:6EQt5YVOSVVEPy+wEMmqiHNpU104B+BDq9J5SV3DY:CSVVEPozmB7+B+FqX5S1D

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 3640	2524	rundll32.exe	16
PID 2524 wrote to memory of 3640	2524	rundll32.exe	16
PID 2524 wrote to memory of 3640	2524	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\58a0949714ee508b77a5e3194b375379.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\58a0949714ee508b77a5e3194b375379.dll,#1
  2⤵
  PID:3640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads