7347d75c5ba92166fb32f0bd6553950e25996c036aa408ec2a7a710ea9d02f18 | Triage

Analysis

max time kernel
139s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 20:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

471b7ce434db0ea9388639c2a14a38cd.dll
Size

6KB
MD5

471b7ce434db0ea9388639c2a14a38cd
SHA1

9bc34f617db87c159240af7f9c7c2ae777039e32
SHA256

7347d75c5ba92166fb32f0bd6553950e25996c036aa408ec2a7a710ea9d02f18
SHA512

e2cc6dfe3188dc153425e4f7f185d841180c1f97d6f52dc453f3a1615f89d56565d543d5fd0633517f962786b71cb1ef5dfce5044d01c34155f413602b907888
SSDEEP

48:6EQt5YVOSVVEPy+wEMmqiHNpU10+B+BDq9J5SV3DY:CSVVEPozmB7wB+FqX5S1D

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 4664	3196	rundll32.exe	15
PID 3196 wrote to memory of 4664	3196	rundll32.exe	15
PID 3196 wrote to memory of 4664	3196	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\471b7ce434db0ea9388639c2a14a38cd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\471b7ce434db0ea9388639c2a14a38cd.dll,#1
  2⤵
  PID:4664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads