c6c223ee2e9067cc84928bd33570087c0c32bf39ec07edfee12001e58c808b60 | Triage

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 04:33

Sharing

Report Analysis Logs

General

Target

0e96e1774a1a674a28df95afe7d587fa.dll
Size

4KB
MD5

0e96e1774a1a674a28df95afe7d587fa
SHA1

663f9903a8560948d325a3881b39d1238bff97e7
SHA256

c6c223ee2e9067cc84928bd33570087c0c32bf39ec07edfee12001e58c808b60
SHA512

8c91d0075c1dd17d175f74fe649dab562fa54d51e75e33322b0757ca49acd47f80120d07eaa007b3af01194b83a388b160e744fe02e4d05c52167623ba63ac64
SSDEEP

96:Z3Z0tmhAdJy82AbHXExNYMnXzZusDfsrsdTSrst:VDhf4rE7csjs6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2996	1964	rundll32.exe	90
PID 1964 wrote to memory of 2996	1964	rundll32.exe	90
PID 1964 wrote to memory of 2996	1964	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e96e1774a1a674a28df95afe7d587fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e96e1774a1a674a28df95afe7d587fa.dll,#1
  2⤵
  PID:2996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2996-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download