e427a8aa176a4d7bf585a8f504176c62b5f701d3538e3e7d5be839823d87c536 | Triage

Analysis

max time kernel
147s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2024 09:47

Sharing

Report Analysis Logs

General

Target

3c887d5550aafc41a3ed11be417a3e6a.dll
Size

32KB
MD5

3c887d5550aafc41a3ed11be417a3e6a
SHA1

3a2aa842fc47cb29e387bcdf2e0593da5536411a
SHA256

e427a8aa176a4d7bf585a8f504176c62b5f701d3538e3e7d5be839823d87c536
SHA512

889995231bfff29c9bca7c47634a62857c92ec9a1f3ea29751682299679af7ddafa3a65fe2b2bda9dce93e3ecc0d6a0df9aeff473c7c0ebeffad5ac1e222a1b0
SSDEEP

768:dr/tsfANEQaQnRXJuJ7IdE+g1QgVO01RqgNwaE8:drtsfAdaQi7IdE+Mb7RND

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 1676	3468	rundll32.exe	16
PID 3468 wrote to memory of 1676	3468	rundll32.exe	16
PID 3468 wrote to memory of 1676	3468	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c887d5550aafc41a3ed11be417a3e6a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c887d5550aafc41a3ed11be417a3e6a.dll,#1
  2⤵
  PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads