0d5524ef202bc8b0bb7a04d791660414b812190f8a7ddb4cedb6873643656831 | Triage

Analysis

max time kernel
150s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 13:53

Sharing

Report Analysis Logs

General

Target

38c5cfd31d82df1c48e5ed334e72d5e8.dll
Size

90KB
MD5

38c5cfd31d82df1c48e5ed334e72d5e8
SHA1

ffd8ce917f57b84c3dc3fce64ef9cba132f5879e
SHA256

0d5524ef202bc8b0bb7a04d791660414b812190f8a7ddb4cedb6873643656831
SHA512

31ad4ae09eda73ad1bb0e9a8efae492b6efa5b0a661059c2e781f38731fe7d1a54746ad5d6dd9e10b4ce7e37eec563c4eb1ef90c2497df91ee6d2ce9624feb5e
SSDEEP

1536:EVlJ2pAXz7JRYcWPljYXhNkrlEYOAulvtR0C4J:EV72aXz3Lar45lvz+

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1920	2044	rundll32.exe	16
PID 2044 wrote to memory of 1920	2044	rundll32.exe	16
PID 2044 wrote to memory of 1920	2044	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38c5cfd31d82df1c48e5ed334e72d5e8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38c5cfd31d82df1c48e5ed334e72d5e8.dll,#1
  2⤵
  PID:1920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads