59db8a5a174eddf4ab5a4207b5c5779aef175f594a12df493c7e2bd7124712ba | Triage

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 03:45

Sharing

Report Analysis Logs

General

Target

26d7caa0faf92c63cdd16f0ca20704f6.dll
Size

6KB
MD5

26d7caa0faf92c63cdd16f0ca20704f6
SHA1

4a924731782dda7c1e5529e18abf9fd4b025897d
SHA256

59db8a5a174eddf4ab5a4207b5c5779aef175f594a12df493c7e2bd7124712ba
SHA512

1273653615f797e269cae16fd92e127eeff8e6e46d855cce2e6a4236a01fd43779987f7f3540336de46def5fe684d08d148c3d0099f80dc04d3b1ff440c759b3
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0SB+BDq9J5SH:VDa9VUX9bQWyB+FqX5SH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 4304	4364	rundll32.exe	12
PID 4364 wrote to memory of 4304	4364	rundll32.exe	12
PID 4364 wrote to memory of 4304	4364	rundll32.exe	12

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26d7caa0faf92c63cdd16f0ca20704f6.dll,#1
1⤵
PID:4304

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26d7caa0faf92c63cdd16f0ca20704f6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads