8ac04875976ff5f2b443dde670ba53f812e7ffff42e72336482081bacb337f38 | Triage

Resubmissions

29-12-2023 08:01

231229-jw3ndsgah2 7

29-12-2023 07:56

231229-jsp8wscgfm 7

Analysis

max time kernel
112s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 07:56

Sharing

Report Analysis Logs

General

Target

_8799F7153471BC8E3B333E972437C11D.dll
Size

239KB
MD5

2d2f84761a9fde81898ed505b227e7e3
SHA1

d213a0de3f4c012c56b58e93a09d15192f513135
SHA256

c99038075ff963da73cebbd80d1462513c72af117f08b379d8d9d2a90a1e5ebf
SHA512

debfd82cd41079cb569de8ab8847847164b3304fbea504287d89bc41ad2070b822bbeb946dce8862b892f82dd2d021942a3e386c2dcf2eada51acfa47a1631f7
SSDEEP

6144:uh77lpNtb01c4i6F/r1SfLuPAS5x/okDR5:q77aLF/rEtGP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 3484	1136	rundll32.exe	87
PID 1136 wrote to memory of 3484	1136	rundll32.exe	87
PID 1136 wrote to memory of 3484	1136	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_8799F7153471BC8E3B333E972437C11D.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\_8799F7153471BC8E3B333E972437C11D.dll,#1
  2⤵
  PID:3484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads