bff9d6b117aaacc58b7b3a7f00d56e4f2a47d3dc0197865a119a87fea8bff98d | Triage

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 20:36

Sharing

Report Analysis Logs

General

Target

f66abb85179bdc9c400e0cd752ded36c.dll
Size

10.0MB
MD5

f66abb85179bdc9c400e0cd752ded36c
SHA1

bd15ba869e2d3590e3d0d3aabfdbabb391e1f9bb
SHA256

bff9d6b117aaacc58b7b3a7f00d56e4f2a47d3dc0197865a119a87fea8bff98d
SHA512

50d8ecf93879296b424e9cecbaf1d07755fe5fcbdac28693b7f86df84b5cb137e329410d01c69814937bf3ac24e57858d294fe5d199c614627e2d1d95aae8565
SSDEEP

12288:nJ+wUeP8lAjjUw9USYIfNlAtW4gZlwtwV/6V:nJ+uP8lAjDUNI4gZy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 4668	228	rundll32.exe	18
PID 228 wrote to memory of 4668	228	rundll32.exe	18
PID 228 wrote to memory of 4668	228	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f66abb85179bdc9c400e0cd752ded36c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f66abb85179bdc9c400e0cd752ded36c.dll,#1
  2⤵
  PID:4668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4668-0-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download
memory/4668-1-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download