4b5546077baa0a1a733698ee036899c4763c50c918a2d50aa7cf6d35c30cbac8 | Triage

Analysis

max time kernel
146s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 06:49

Sharing

Report Analysis Logs

General

Target

2c363d068f42a910fa8470698baa09be.dll
Size

136KB
MD5

2c363d068f42a910fa8470698baa09be
SHA1

a00ae6923a8bbdd077745a1e0e429891093dc185
SHA256

4b5546077baa0a1a733698ee036899c4763c50c918a2d50aa7cf6d35c30cbac8
SHA512

1608d7fa88e43654bc1af63977bdf9f507e541b40857886a61559647e26216d7d34a041c527796095537ff09749e9ba390e0e91254cf6d003c60c3243b04906b
SSDEEP

3072:3obvCkGLLLhn1b30i/6fOkReKlee4lvg:YbyN1T0iyfO/Fe4t

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 1072	4988	rundll32.exe	16
PID 4988 wrote to memory of 1072	4988	rundll32.exe	16
PID 4988 wrote to memory of 1072	4988	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c363d068f42a910fa8470698baa09be.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c363d068f42a910fa8470698baa09be.dll,#1
  2⤵
  PID:1072

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -l WATCHDOG WATCHDOG-20240102-1127.dmp
1⤵
PID:4784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads