41a0823d1710248c543e8a19feb61bc69dd9b16aeb7f2d8f49c78e2f8a415ae7 | Triage

Analysis

max time kernel
151s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 21:07

Sharing

Report Analysis Logs

General

Target

DSC0600212.dll
Size

383KB
MD5

85c6cc78facdcfe9afed709bdb3ee318
SHA1

b36e8a357d92610825f16f9353a1b2d2bba125eb
SHA256

defcef9188c6691bc87d1e4e3d3dc6ab63d2bc7538f7e36e8a1f2baa5d84a0e4
SHA512

e563d06cfce46518cd4b97e976bf522a550ff7062c0192c0cba0039f567b57f311354dddf89dccdbcaf373de5a8e208f08fde13b418228b66221f1eb80358cfd
SSDEEP

6144:NqigI8JSOMgfLsnzB6XvPb7Ckxu9VV4AC/IawBZtW6IyedsfVwus:V8JScDsnzB6/Pnrxu90Gt

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 4752	1412	rundll32.exe	89
PID 1412 wrote to memory of 4752	1412	rundll32.exe	89
PID 1412 wrote to memory of 4752	1412	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DSC0600212.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DSC0600212.dll,#1
  2⤵
  PID:4752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4752-0-0x0000000000690000-0x00000000006F5000-memory.dmp

Filesize
404KB

Download