04e77b65bab3db9609a7ae05e44ffb2318958ebb67fb33011b7f206c2b3b9389 | Triage

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 11:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

48eb43078c18df16f2b4a538237a955d.dll
Size

2.3MB
MD5

48eb43078c18df16f2b4a538237a955d
SHA1

592dc64911723a512c1d376eba23b984696e2db4
SHA256

04e77b65bab3db9609a7ae05e44ffb2318958ebb67fb33011b7f206c2b3b9389
SHA512

5ed443eec0392d0911d18d43308387d9de2d259ebc7a4e8f32c6f06b72cb4b1830b4dcfa4a26fe2b3423e4881d0f00308da5a94aaea6fa8af8201f3654579e36
SSDEEP

49152:2ZEm+G6qGJ2f3iRfX9/GZDCBywcLen7QD/78:wF+T52fSR5UDjLe7QLo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 1752	3732	rundll32.exe	16
PID 3732 wrote to memory of 1752	3732	rundll32.exe	16
PID 3732 wrote to memory of 1752	3732	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48eb43078c18df16f2b4a538237a955d.dll,#1
1⤵
PID:1752

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48eb43078c18df16f2b4a538237a955d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1752-0-0x0000000020000000-0x000000002006C000-memory.dmp

Filesize
432KB

Download