12b61ace0d283a83fde10983f4ba8fec85cbbd4d5464608897992e77ac364fbb | Triage

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 19:19

Sharing

Report Analysis Logs

General

Target

0182e32e4aeaa2f4fcd0507290c777b2.dll
Size

1.0MB
MD5

0182e32e4aeaa2f4fcd0507290c777b2
SHA1

a6c76e5740a5b29a2fbdc0de629ac5e1ef8b8e34
SHA256

12b61ace0d283a83fde10983f4ba8fec85cbbd4d5464608897992e77ac364fbb
SHA512

5252a1c3466ed35533240c3304af8e6d07239a8dfa1044a035a42abcc44428f67e62cc6a1888d5270355f78928eb9015cb5de235f16d91e9f05aa6347a45d122
SSDEEP

24576:YfyPYMaso1eHuUZvhu+pS0+M3tb0pvaep5ZFNFIN:HPG1ephu/0J3tCieDgN

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 688 wrote to memory of 3588	688	rundll32.exe	37
PID 688 wrote to memory of 3588	688	rundll32.exe	37
PID 688 wrote to memory of 3588	688	rundll32.exe	37

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0182e32e4aeaa2f4fcd0507290c777b2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0182e32e4aeaa2f4fcd0507290c777b2.dll,#1
  2⤵
  PID:3588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads