63caee8501031993bd0d36efb9635fb0410b8396f48fded9c46b41153f5b4977 | Triage

Analysis

max time kernel
179s
max time network
224s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 15:53

Sharing

Report Analysis Logs

General

Target

3a7a01bfab73207d11837597925eb6f0.dll
Size

876KB
MD5

3a7a01bfab73207d11837597925eb6f0
SHA1

fc1024fb27783fcde824f9b872688ed436c22d5f
SHA256

63caee8501031993bd0d36efb9635fb0410b8396f48fded9c46b41153f5b4977
SHA512

99ceea27c911d36b29e4d16a73240f15bb7ab98c2b8effec05adef8fb81d5084647865d1d8089034441fed81e8720162a5a7e46c8d39eb438f42228963f44140
SSDEEP

24576:GPF3n6MYjlRk95gdOLZa5cNTt4qDRk7adIKxQXJ:GPF3Yn8594qD27addx8

Score

1^/10

Malware Config

Signatures

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3584	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 3584	2980	rundll32.exe	89
PID 2980 wrote to memory of 3584	2980	rundll32.exe	89
PID 2980 wrote to memory of 3584	2980	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a7a01bfab73207d11837597925eb6f0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a7a01bfab73207d11837597925eb6f0.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads