aff7d42bdd6af946a3e54a77450d6d64eb11d645f73e601f5bc9b1d32ce74209 | Triage™

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 18:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
46f006ffd13bda1dbb294fdbb7d1b021.dll
Size 3KB
Sample240106-xf1qrafbc8
SHA256 aff7d42bdd6af946a3e54a77450d6d64eb11d645f73e601f5bc9b1d32ce74209
MD5 46f006ffd13bda1dbb294fdbb7d1b021
SHA1 4051737433b7b161c5ca353ea01ee05eedb0e7f3
SHA512 4e0bb6e127d1c56154a50d7f8f336b3d5db762592fbf6ded2f137bd8cc903cdc2a2dd0b79985369c67b49b78394ad27a85c7c78494e857c3c8b87f0e307a186a
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1736	2512	rundll32.exe	63
PID 2512 wrote to memory of 1736	2512	rundll32.exe	63
PID 2512 wrote to memory of 1736	2512	rundll32.exe	63

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46f006ffd13bda1dbb294fdbb7d1b021.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\46f006ffd13bda1dbb294fdbb7d1b021.dll,#1
  2⤵
  PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads