1829b63b5f33495ae325dc289167381db09347afb5653e876aa76ca7d3ff35c2 | Triage

Analysis

max time kernel
144s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 04:56

Sharing

Report Analysis Logs

General

Target

0f3e47080b37395638680874394b49e5.dll
Size

80KB
MD5

0f3e47080b37395638680874394b49e5
SHA1

0bd26f69eebc1a3f700f2240ae6440c01014f020
SHA256

1829b63b5f33495ae325dc289167381db09347afb5653e876aa76ca7d3ff35c2
SHA512

eb376ca8b2736a407db424d7050c5894fd9033e2daf679843c5bcdd8a672e7b1c871ea594d4c155de3d4857d786e84a641ff37a48e501c5dcef3fe0afbdf220c
SSDEEP

1536:JoEPKYEDDnySeEqR3uKiwSpdJ23Pp6Mjlvr:JZADDyteKi3Wp6Mjlvr

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 3648	3448	rundll32.exe	78
PID 3448 wrote to memory of 3648	3448	rundll32.exe	78
PID 3448 wrote to memory of 3648	3448	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f3e47080b37395638680874394b49e5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f3e47080b37395638680874394b49e5.dll,#1
  2⤵
  PID:3648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads