a44ea0302056a087365ea5611e22704ce0a5256d3d8c238981ab9cd20d0e6113 | Triage

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 07:32

Sharing

Report Analysis Logs

General

Target

2d81d4d373dcfbf58c6a0154369ea476.dll
Size

6KB
MD5

2d81d4d373dcfbf58c6a0154369ea476
SHA1

2407881fabada4c2680ed9e85e8a3cfcd784f4c5
SHA256

a44ea0302056a087365ea5611e22704ce0a5256d3d8c238981ab9cd20d0e6113
SHA512

ca646574d89750bad018b0a459e4e229a1cc10628cdbc9b0c42109f70a58c91cb84c677a6cb4f4bc90e85ea03d929fdbee16a79f30132c9cda7b0747076b0fd7
SSDEEP

48:6AA35YVOQDV8FszwydlAYsLFV3G0iB+BDq9J5S2:0QDV8FscMjsLFV3KB+FqX5S2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 1400	3724	rundll32.exe	14
PID 3724 wrote to memory of 1400	3724	rundll32.exe	14
PID 3724 wrote to memory of 1400	3724	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d81d4d373dcfbf58c6a0154369ea476.dll,#1
1⤵
PID:1400

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d81d4d373dcfbf58c6a0154369ea476.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads