7b900a4dc88b815e6f59592a49c7604faca3cf331abed7b6d89313315d816848 | Triage

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 15:27

Sharing

Report Analysis Logs

General

Target

78d90e99c4be8430f25b9ddad3f69b2e.dll
Size

609KB
MD5

78d90e99c4be8430f25b9ddad3f69b2e
SHA1

5fa1c388ba10b20f1ee52d2ab6564dabd4a87337
SHA256

7b900a4dc88b815e6f59592a49c7604faca3cf331abed7b6d89313315d816848
SHA512

c9405c1641b6a8adbefd09abdde801deb3446350e462a174daadcdc4d893c36e41c2ff2366909cc98c880445ec72b38454005e085a8648e6b5b0817b1410ffe2
SSDEEP

768:Cu1GPvjhjM0mK5FkgdRnG4QA7ayEi6PAdQqqf:7wjtBhRnG4/PJG

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 5056	980	rundll32.exe	14
PID 980 wrote to memory of 5056	980	rundll32.exe	14
PID 980 wrote to memory of 5056	980	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78d90e99c4be8430f25b9ddad3f69b2e.dll,#1
1⤵
PID:5056

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78d90e99c4be8430f25b9ddad3f69b2e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5056-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download