cfd18a8f5dc6e779834e9e68389248164c775d93fd71389b5612beb1a145a95d | Triage

Analysis

max time kernel
139s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 09:17

Sharing

Report Analysis Logs

General

Target

144910e6cbcdc73db47408a08605a4f2.dll
Size

6KB
MD5

144910e6cbcdc73db47408a08605a4f2
SHA1

e17b6fa6a045941b74a8c3043165b82c6bf3b040
SHA256

cfd18a8f5dc6e779834e9e68389248164c775d93fd71389b5612beb1a145a95d
SHA512

4f5bacb22b7256f375c720b88595dcf7c23d48beb333051c1509412244aa5191cd8daf62fd5c45213bf8cf1f5d29b700931b9bf83fb4e15548799e25f1d13abc
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0cB+BDq9J5SH:VDa9VUX9bQW8B+FqX5SH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 388	2596	rundll32.exe	17
PID 2596 wrote to memory of 388	2596	rundll32.exe	17
PID 2596 wrote to memory of 388	2596	rundll32.exe	17

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\144910e6cbcdc73db47408a08605a4f2.dll,#1
1⤵
PID:388

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\144910e6cbcdc73db47408a08605a4f2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads