6cd06a2fb8b02a9d80fdf90e58c215025579165a768112c23c11c4d221391a93 | Triage

Analysis

max time kernel
157s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 05:55

Sharing

Report Analysis Logs

General

Target

2ad34dd7899da1ac868b4003cb1cd119.dll
Size

12KB
MD5

2ad34dd7899da1ac868b4003cb1cd119
SHA1

cf015778b92591e9003d2c01f2b80b9b76d11622
SHA256

6cd06a2fb8b02a9d80fdf90e58c215025579165a768112c23c11c4d221391a93
SHA512

cbcaa53c1472013246679c83274452c1eb622a32e57f323859d12cd5f01b6ce94a8b5c9d36ea8ee13759acc11d175717989c78ad7574949ef424d9f249a580a9
SSDEEP

384:8kUAGOuzTPb83Tt9X+8COCXGrqMIppz8pU:5UA4T8DtBn7rT2d8pU

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 3432	3180	rundll32.exe	89
PID 3180 wrote to memory of 3432	3180	rundll32.exe	89
PID 3180 wrote to memory of 3432	3180	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ad34dd7899da1ac868b4003cb1cd119.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ad34dd7899da1ac868b4003cb1cd119.dll,#1
  2⤵
  PID:3432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3432-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3432-1-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/3432-2-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3432-3-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download