b97d007d1fb516a5a8b1b39e8d9ede7844de67fe9f55facf7c1023dc97464d90 | Triage

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 07:54

Sharing

Report Analysis Logs

General

Target

12b6dafa26cffd0f3c51c939603205f4.dll
Size

48KB
MD5

12b6dafa26cffd0f3c51c939603205f4
SHA1

4a6a3a0d2fe8258df0be283b55fb2fb266e2f0a4
SHA256

b97d007d1fb516a5a8b1b39e8d9ede7844de67fe9f55facf7c1023dc97464d90
SHA512

5c0fadb52dbd02d778826d687249de4e61875cdbc4d97c5f01c9fc7218ea7e16cff17b6aca9bb3f0b587849b7269bba2461de28bd97ac6aa5ab6df890d605706
SSDEEP

768:KH8uCdY3tCVyJtsG/IIWbEKIPPrAuamStmtsL29sS:KcuCy33Jt5obRIPjADFmt6

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
17	1332	rundll32.exe
40	1332	rundll32.exe
68	1332	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 1332	1140	rundll32.exe	88
PID 1140 wrote to memory of 1332	1140	rundll32.exe	88
PID 1140 wrote to memory of 1332	1140	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12b6dafa26cffd0f3c51c939603205f4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\12b6dafa26cffd0f3c51c939603205f4.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:1332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads