c183b91f94025ca3ff62076f64e851772029ef184844a79aafb8c043e5fa3898 | Triage

Analysis

max time kernel
144s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

691b3ac4a4837bdc91ab611b5c26f82e.dll
Size

223KB
MD5

691b3ac4a4837bdc91ab611b5c26f82e
SHA1

2448ac43be19a9eebdb753f0f6711995afa4f98c
SHA256

c183b91f94025ca3ff62076f64e851772029ef184844a79aafb8c043e5fa3898
SHA512

637e34f86f71fd5532d6e03e889cafb910e53b1c03555f51ebe88b02874ac85cf233ebeffd29a3f19ffba959068c37e5d478b30f18cfbbe092aa28ab147cde4e
SSDEEP

6144:RgaZymUWA3KVwxTXimTSEueoaUeYIG2YAE:+bmpA3KVwxTNMeVG2Yx

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 1856	1428	rundll32.exe	16
PID 1428 wrote to memory of 1856	1428	rundll32.exe	16
PID 1428 wrote to memory of 1856	1428	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\691b3ac4a4837bdc91ab611b5c26f82e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\691b3ac4a4837bdc91ab611b5c26f82e.dll,#1
  2⤵
  PID:1856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads