f172ec46a501f46e3f9a01cba73c32dfe46b20f7ed6d9aaafa39515567d43665 | Triage

Analysis

max time kernel
148s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2024, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

42ae01a2876a71ca6b5daff6deab4b88.dll
Size

14KB
MD5

42ae01a2876a71ca6b5daff6deab4b88
SHA1

f29da216d21e1709ca1a1fd25c75b50de76b0054
SHA256

f172ec46a501f46e3f9a01cba73c32dfe46b20f7ed6d9aaafa39515567d43665
SHA512

f11ffd137eff928dd154221999a77b9dcb4722a9df5879a5ad36ea74ec3f4759f303f338e3932245b9d052d4e04ef805e6274513aaa14786cd283f14fb9dda8f
SSDEEP

384:sLyKfRtlJGO73hhppY4Z/iSUeuX6/YUGCRNX:32RtlJGOTrjYGGb6/YUG0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 2712	3744	rundll32.exe	16
PID 3744 wrote to memory of 2712	3744	rundll32.exe	16
PID 3744 wrote to memory of 2712	3744	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\42ae01a2876a71ca6b5daff6deab4b88.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\42ae01a2876a71ca6b5daff6deab4b88.dll,#1
  2⤵
  PID:2712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2712-0-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download