02021698f97349fb3ddb919664a39ce831ee9e5689c35f27150830e8cd13d2ba | Triage

Analysis

max time kernel
147s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

06482f80c7d66f0d714d74da9a437344.dll
Size

32KB
MD5

06482f80c7d66f0d714d74da9a437344
SHA1

ca1b1afe07dd0895d55026d570da65ace135d884
SHA256

02021698f97349fb3ddb919664a39ce831ee9e5689c35f27150830e8cd13d2ba
SHA512

2797d75e247138e6a3abe8ff230f5a14aadfff48576ced0b640be7a0363a47826b6874dc34b954c7eb6acd1fb68a06d3067a3b59bad62b21f6faac91c9854e66
SSDEEP

768:pQ/z6OMFzi7IvwxHsXgcuScodDdYYOUgq/r:pQLaBvKBopdPj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 1472	4916	rundll32.exe	16
PID 4916 wrote to memory of 1472	4916	rundll32.exe	16
PID 4916 wrote to memory of 1472	4916	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06482f80c7d66f0d714d74da9a437344.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06482f80c7d66f0d714d74da9a437344.dll,#1
  2⤵
  PID:1472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads