48ec84cc5cae76a524ec726192f646da684d44448e3e715ccd03a9bc14ead63c | Triage

Analysis

max time kernel
147s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 14:15

Sharing

Report Analysis Logs

General

Target

3973fe4a509c40b8ee50a92f9dfbde98.dll
Size

12KB
MD5

3973fe4a509c40b8ee50a92f9dfbde98
SHA1

7abf77509a3e6b8e4b8233c6794de6a78f96e17b
SHA256

48ec84cc5cae76a524ec726192f646da684d44448e3e715ccd03a9bc14ead63c
SHA512

e23900391fa2bebe5e916adafb74f8e7a28d69eebb0060dda2031416379ef4455e6281da709ed5469b168ca5a5edbeb81f4d2e40fc1c326de2f7e6359f7abfde
SSDEEP

192:nnVwYHQvSSKPcTnpspF11kqJKfI8vfsmf0b77:VwYjQnIF16q2Nfs60P7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 5044	1692	rundll32.exe	14
PID 1692 wrote to memory of 5044	1692	rundll32.exe	14
PID 1692 wrote to memory of 5044	1692	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3973fe4a509c40b8ee50a92f9dfbde98.dll,#1
1⤵
PID:5044

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3973fe4a509c40b8ee50a92f9dfbde98.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads