dd1052b778a376f24bc084149607b536859cd7294ddf3b43d6124c556ca3c42b | Triage

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 20:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0352644f5d3851f139a05b3d98cab9d4.dll
Size

156KB
MD5

0352644f5d3851f139a05b3d98cab9d4
SHA1

13573279079ef082d5c16554caadfcd5e6434964
SHA256

dd1052b778a376f24bc084149607b536859cd7294ddf3b43d6124c556ca3c42b
SHA512

851f5d6af029f646e299f66d7bed91d1be74622f0f9521df507c55b178274f8058f15929121220d3fa167ac55304dfd21eff11539ce30a2a39ca65cf5cd07fca
SSDEEP

3072:56yI+TCuzTFdwwsYU+iUA9x1KCRuqKfrf+Ok09ADVFz:g+lPwwsYUzUU1Lb3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 2828	5052	rundll32.exe	14
PID 5052 wrote to memory of 2828	5052	rundll32.exe	14
PID 5052 wrote to memory of 2828	5052	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0352644f5d3851f139a05b3d98cab9d4.dll,#1
1⤵
PID:2828

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0352644f5d3851f139a05b3d98cab9d4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads