2ed3983a685bd9f544ca573f17e513355efd658f4b9939b943c792b78f95e802 | Triage

Analysis

max time kernel
148s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 02:39

Sharing

Report Analysis Logs

General

Target

0bf1a384f3ef21d32dee1fa5bc45662e.dll
Size

19KB
MD5

0bf1a384f3ef21d32dee1fa5bc45662e
SHA1

afac6af30ba92ac1e7aba893a2553386aeed7d63
SHA256

2ed3983a685bd9f544ca573f17e513355efd658f4b9939b943c792b78f95e802
SHA512

6570b7a57a1927d2d081673f2256da36533e0e211066b5808f39fa7b47a72981efa370027d444dc1fbd29cf07bd7cbc7d65444f194a0b59948f0610e7f89fcc8
SSDEEP

384:+lv4YiKEjcYXmmDP5Eiz43s9ORqR6RhRKR9+R++RyRT:eATKEjNxbk3xwkXAuVo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 1920	3216	rundll32.exe	63
PID 3216 wrote to memory of 1920	3216	rundll32.exe	63
PID 3216 wrote to memory of 1920	3216	rundll32.exe	63

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bf1a384f3ef21d32dee1fa5bc45662e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bf1a384f3ef21d32dee1fa5bc45662e.dll,#1
  2⤵
  PID:1920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads