53b4bb77726d8f6074d984dbc2a07e2b74bc12fbd2d067515d84941ae13a9cab | Triage

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2023 03:54

Sharing

Report Analysis Logs

General

Target

00026720.dll
Size

762KB
MD5

1165a78fb0a82d79d66b2ec101db82e5
SHA1

1329675e6da15c77f249f72900cfdcc63b7756fd
SHA256

05e060cfb5bc5b1ddbe23e1e1537c3c7692137f8fbe51a6ada0dc7e8003e66d7
SHA512

2b5da6cecb211efbda6435d8d34cc8aa5103b65527104972c73aae42e2cc6274dad0033fe273c8d765db01f7ad541f2a53d197a846a1bf81c9e43289230cbfba
SSDEEP

6144:hZW5+10SD8AuxnqVmH9w7+P3PkkUHp6BZHhi3WXzpFtmNy:hZPbD8AynK+PLBZHhi3WX3tmN

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1372 wrote to memory of 4032	1372	rundll32.exe	rundll32.exe
PID 1372 wrote to memory of 4032	1372	rundll32.exe	rundll32.exe
PID 1372 wrote to memory of 4032	1372	rundll32.exe	rundll32.exe

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00026720.dll,#1
1⤵
PID:4032

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00026720.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...