6e07cac99480f9ff5d1f3ccbc2750b6136386c24c2f29d839e6736e1636fce58 | Triage™

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
285d2ff60849aaae6fd7c5bb8f6659ad.dll
Size 3KB
Sample231231-e7j8zacgaq
SHA256 6e07cac99480f9ff5d1f3ccbc2750b6136386c24c2f29d839e6736e1636fce58
MD5 285d2ff60849aaae6fd7c5bb8f6659ad
SHA1 48867fafb82d5413186b5311c5a885f0e8ae5e5b
SHA512 31350018ce4b99df60d9a595c37018e9de44121fab96d401b620a780b914be536b63f13e0b8a6cac7c1435fac3ee4c6ba59f32fec06ee79d468bedd8079e6292
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 1448	4392	rundll32.exe	14
PID 4392 wrote to memory of 1448	4392	rundll32.exe	14
PID 4392 wrote to memory of 1448	4392	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\285d2ff60849aaae6fd7c5bb8f6659ad.dll,#1
1⤵
PID:1448

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\285d2ff60849aaae6fd7c5bb8f6659ad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads