22c14ff12f73599b0a22e54890cb26a95221cdd154ee4c170e7070e2f428386d | Triage

Analysis

max time kernel
158s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2024 17:37

Sharing

Report Analysis Logs

General

Target

Output/NetReg/x86/AdguardNetLib.dll
Size

165KB
MD5

77b9375d5e5efbac17e2034e46f66689
SHA1

c40a1538899a36a26a50a7a873b2eaa45c935457
SHA256

42beaa5e0cf8a6c7d13cc55f78bbaf479367835d6435fb424f5e85bd8d328be5
SHA512

ab461f7ccda0eca813d7edc0bc92079b04ea2ff403508ae0a48f35a9e986b6eeaf44bd6fb09ed4a818c91f80723bc17a09a51102feabe6bb881889ffba2fd240
SSDEEP

3072:Y8wV68fVWThTSmo5Nbc8tyvsqTP1VUiXhhV/:wfwl2RNnt+rgmhV/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 3372	3148	rundll32.exe	88
PID 3148 wrote to memory of 3372	3148	rundll32.exe	88
PID 3148 wrote to memory of 3372	3148	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Output\NetReg\x86\AdguardNetLib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Output\NetReg\x86\AdguardNetLib.dll,#1
  2⤵
  PID:3372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads