08ae6f5991b9507a4914a9d2be30fc99eca066b162c1e0f01b1fd8d43c5cfc3e | Triage

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 07:13

Sharing

Report Analysis Logs

General

Target

11dc184700b2d206d262162ea32d2775.dll
Size

6KB
MD5

11dc184700b2d206d262162ea32d2775
SHA1

502b3b009751659d2bddb9442a13786eb2b276b5
SHA256

08ae6f5991b9507a4914a9d2be30fc99eca066b162c1e0f01b1fd8d43c5cfc3e
SHA512

54b7878eae45c31c63c626f5434a4b2d0cad0425609a9cf71bc96c1e127d3d81a5af1a97cf5db64b447f9aacaacb2772c46156d88b7398f9fe854df178646bc2
SSDEEP

192:WWWfN2Xr4ZJBgZf/gSGJEIJhD956GxPkgUw9F:W1NAcx0/PZIi/a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 4100	4316	rundll32.exe	86
PID 4316 wrote to memory of 4100	4316	rundll32.exe	86
PID 4316 wrote to memory of 4100	4316	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11dc184700b2d206d262162ea32d2775.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\11dc184700b2d206d262162ea32d2775.dll,#1
  2⤵
  PID:4100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4100-0-0x0000000025000000-0x0000000025012000-memory.dmp

Filesize
72KB

Download