5e38af5c224d2dabee937b0a08fc79c79c6bab75256fbf349816c8d9d81fa2a2 | Triage

Analysis

max time kernel
153s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 23:29

Sharing

Report Analysis Logs

General

Target

06f1a1adfd23a367c20069f29581c4cf.dll
Size

2.2MB
MD5

06f1a1adfd23a367c20069f29581c4cf
SHA1

c9d810ec2c52a32f9936d67215b724492b10e207
SHA256

5e38af5c224d2dabee937b0a08fc79c79c6bab75256fbf349816c8d9d81fa2a2
SHA512

038ebce369b190a15b2cae47a12fe208edcd1ef24d1047392cd1608802be334d035de023dc7ba3ea87aaf892d8e07f0c0c21c12f7e495de75837d638b82517dc
SSDEEP

49152:2G6qGJ2f3iRfX9/GZDCBywcLen7QD/7ux9:2T52fSR5UDjLe7QLO9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 812	4904	rundll32.exe	89
PID 4904 wrote to memory of 812	4904	rundll32.exe	89
PID 4904 wrote to memory of 812	4904	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06f1a1adfd23a367c20069f29581c4cf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06f1a1adfd23a367c20069f29581c4cf.dll,#1
  2⤵
  PID:812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/812-0-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/812-2-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download