98184786c4cf8300c5848307f96f2251764f3da8e4c0eda81da474f8d8ab9979 | Triage

Analysis

max time kernel
145s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 01:14

Sharing

Report Analysis Logs

General

Target

09ba099e04c9a897eb8f970636f2d34a.dll
Size

16KB
MD5

09ba099e04c9a897eb8f970636f2d34a
SHA1

a27b274b875bb27ddf021b345ba03b2378619fb3
SHA256

98184786c4cf8300c5848307f96f2251764f3da8e4c0eda81da474f8d8ab9979
SHA512

21d214f914e3f4edb94818572945d48f7e28a98356395ca8e7711e5cfb53765d282b1ba2ef6cf4131d0e866d5a348136f69e0f6cae359a53b1ed2fae86d71164
SSDEEP

384:FTgDfPghDxYC6a2lUl8G7mX2nIHMVcDYQHGvpDp5:FcwR6W8GZwH2D7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 5084	4656	rundll32.exe	89
PID 4656 wrote to memory of 5084	4656	rundll32.exe	89
PID 4656 wrote to memory of 5084	4656	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09ba099e04c9a897eb8f970636f2d34a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09ba099e04c9a897eb8f970636f2d34a.dll,#1
  2⤵
  PID:5084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5084-0-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download