5ea29fbd1af7802ac2fb5c5f1b00e1ceac736e9a3e1262b594012c6e8e69806e | Triage

Analysis

max time kernel
147s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 13:05

Sharing

Report Analysis Logs

General

Target

70bca4b18ed1922cb1814e656c3b7ef0.dll
Size

280KB
MD5

70bca4b18ed1922cb1814e656c3b7ef0
SHA1

b37c99aba5d2e4e45b302852110e55b55de707b1
SHA256

5ea29fbd1af7802ac2fb5c5f1b00e1ceac736e9a3e1262b594012c6e8e69806e
SHA512

68133a8b9536fc8dd60c3cdd28489a69bf4bee915a23adfbbd1d9917d3e4629bec6d53f57dc25953a93f1a395c475e53029266e3bec64894658f792f78cd6a5b
SSDEEP

3072:mgDHda/lPTCjdEHBMedmXhGCgU6d1jDE1:hMl7C6hNdmUCM1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 2932	4720	rundll32.exe	19
PID 4720 wrote to memory of 2932	4720	rundll32.exe	19
PID 4720 wrote to memory of 2932	4720	rundll32.exe	19

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\70bca4b18ed1922cb1814e656c3b7ef0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\70bca4b18ed1922cb1814e656c3b7ef0.dll,#1
  2⤵
  PID:2932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2932-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download