a3924df964a4e90c60ab76c7627706dd4986c06c3c513b9dae66d2cb9dc80fe1 | Triage

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 08:01

Sharing

Report Analysis Logs

General

Target

lib/ImportDDS.dll
Size

36KB
MD5

40d8d6572abf537677427cf2e44e3c3d
SHA1

34c87824767848f2c6b0cd93c2a137d53f936207
SHA256

64e75710a4978fbf6723ff2a6eb613e74342db0ee403adaa1bc87010a60d3b74
SHA512

d0ed810fe18ebc91d036ffcb3c3462ffcbd34420a2ce802212efca65a266119bfa53a17124746fb82945fa772b3456eae65cded223e52bedb090ecddd5c64e9b
SSDEEP

384:rEzQJoPg1ZXl+s2VbjM4BVZL0bF48YrLD1LZo8MPHXO5v79Xq:roMjL+s2Vg2VZLACo8iHXi7Fq

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 3660	3548	rundll32.exe	12
PID 3548 wrote to memory of 3660	3548	rundll32.exe	12
PID 3548 wrote to memory of 3660	3548	rundll32.exe	12

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\ImportDDS.dll,#1
1⤵
PID:3660

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\ImportDDS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads