4e9d478ce9356e1af5a02a6cb84d544d02d1e4db17ec9695e569c40d77864be0 | Triage

Analysis

max time kernel
137s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 13:02

Sharing

Report Analysis Logs

General

Target

19555335220a78d9a15f0b4cc268cb90.dll
Size

14KB
MD5

19555335220a78d9a15f0b4cc268cb90
SHA1

461a0a0daf6ee6af101f68413e008ffd126f124a
SHA256

4e9d478ce9356e1af5a02a6cb84d544d02d1e4db17ec9695e569c40d77864be0
SHA512

385a398039a719ddd25abdd27e8efcc5248bab788432315ff8565a2c3072459afd95e75a9069ce27a16170787719918ee86e864a8f6e1a7456449872b98eff54
SSDEEP

384:eKLFLqGrUAvTNmxOCS3Ijf/3Mj06MYzYF:3CxOC9r3Mj0ts2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 1840	4552	rundll32.exe	90
PID 4552 wrote to memory of 1840	4552	rundll32.exe	90
PID 4552 wrote to memory of 1840	4552	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\19555335220a78d9a15f0b4cc268cb90.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\19555335220a78d9a15f0b4cc268cb90.dll,#1
  2⤵
  PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 1840 -ip 1840
1⤵
PID:3344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads