5464491219d06ebb7fb0e1e331f3944764ea6e8a7f7014b1d60cb70804341851 | Triage

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 04:12

Sharing

Report Analysis Logs

General

Target

0e0cb4237695952390635d644174c888.dll
Size

97KB
MD5

0e0cb4237695952390635d644174c888
SHA1

0220257d1a76a93cb5f2ce5ffeefff9c8bfb81b8
SHA256

5464491219d06ebb7fb0e1e331f3944764ea6e8a7f7014b1d60cb70804341851
SHA512

b5b15fb0a5b41acb889559d1dd0ff17b12f6b8ba93ba1315119afc6913eedb66ff5020f46bd14edba32515e1d64a5f7fa490000632c99d520361d4bc7019490c
SSDEEP

3072:eeszgDU7kI+l0N5hlE53cTIszGwUFMxtz:YB7kIhdWyc6X

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 1292	4492	rundll32.exe	80
PID 4492 wrote to memory of 1292	4492	rundll32.exe	80
PID 4492 wrote to memory of 1292	4492	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e0cb4237695952390635d644174c888.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e0cb4237695952390635d644174c888.dll,#1
  2⤵
  PID:1292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1292-0-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/1292-1-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download