52c3fd76c624c8cb0df55bb11f66b47a0eada2c9fc313e7fd7872dbb23ed148f | Triage

Analysis

max time kernel
142s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 07:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2cf4aa3ee0c5888ae15d4d5709aff42d.dll
Size

32KB
MD5

2cf4aa3ee0c5888ae15d4d5709aff42d
SHA1

7b14639f6fbe37cebba9b60632d2135ad39d4a0a
SHA256

52c3fd76c624c8cb0df55bb11f66b47a0eada2c9fc313e7fd7872dbb23ed148f
SHA512

9e07652ee2fd8ccbec6a32d1b0e6b4732c47b42f09ed3ad5115878b846bafc2910bf11bee1bcf94d2877c03b29ad9119afb6118e19b4527574941b17a81370a1
SSDEEP

768:dUDjbYjOVw9bJm7XJJvsiHBBzhA/ERghu8:d8wOVwhA7XJJvNHBpisRIB

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 3036	3624	rundll32.exe	14
PID 3624 wrote to memory of 3036	3624	rundll32.exe	14
PID 3624 wrote to memory of 3036	3624	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cf4aa3ee0c5888ae15d4d5709aff42d.dll,#1
1⤵
PID:3036

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cf4aa3ee0c5888ae15d4d5709aff42d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads