Analysis
-
max time kernel
139s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2023 05:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2ae5301d0e1056d9a6bbec6e7320ed4e.dll
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2ae5301d0e1056d9a6bbec6e7320ed4e.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
2ae5301d0e1056d9a6bbec6e7320ed4e.dll
-
Size
68KB
-
MD5
2ae5301d0e1056d9a6bbec6e7320ed4e
-
SHA1
5fadc0ad40db1962158597292ac7b9b95ceca43a
-
SHA256
5a32ea1d082522fd2542ab7c82bb41b78fcc79d75a7c7b23f4b23ea5b958617c
-
SHA512
aeaf60f7381af3ab578050082712c0a897d539404a581a22916fcfbbfd755447f612c5d293a1665cea0bdf513d7b82d576bc68ff65c985f5b0ca4a11b056bb2e
-
SSDEEP
1536:Pxx0Zjh+ZzUkfRuOlKI6LyIJ52nPuPJk9F:Pxx0Nh+dUkfRuOlKI6eIbGuPSz
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2128 wrote to memory of 5096 2128 rundll32.exe rundll32.exe PID 2128 wrote to memory of 5096 2128 rundll32.exe rundll32.exe PID 2128 wrote to memory of 5096 2128 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2ae5301d0e1056d9a6bbec6e7320ed4e.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2ae5301d0e1056d9a6bbec6e7320ed4e.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5096-0-0x0000000000CE0000-0x0000000000CE8000-memory.dmpFilesize
32KB