87eb0ce5d7bb6cec573eea2b2a1fc70d89c346898ea9a7ab526fc7452654bb68 | Triage

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2024 10:44

Sharing

Report Analysis Logs

General

Target

Loader/etc/luIelD.dll
Size

2.9MB
MD5

4752c15e18992f946e5d22ac017afe65
SHA1

783110dbfc5598a773265ee925df6f2814e89ce4
SHA256

215931f9665cc1e3d195579c26269fd91075a81937e539e95aeb3a36d401ba8d
SHA512

3d2d4e9b46ad2570536b1281f385d877f03f2fc7aff34d6fb206d7eefa8a9e629b81cfc48fe949420040253eed8a7d8cb1458f714ecf1f6159368969316811c6
SSDEEP

49152:P+4TMh932FULUE/xuMWaPFkpI7D0C2LyEi:PHMhYFUJ/vUGwO

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1188 wrote to memory of 3944	1188	rundll32.exe	rundll32.exe
PID 1188 wrote to memory of 3944	1188	rundll32.exe	rundll32.exe
PID 1188 wrote to memory of 3944	1188	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Loader\etc\luIelD.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1188

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Loader\etc\luIelD.dll,#1
2⤵
PID:3944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3944-1-0x0000000002390000-0x0000000002890000-memory.dmp

Filesize
5.0MB

Download