694d262d2fb5e8566764bc7cd5ed15cd56be8591cac1634139758dd712a60d58 | Triage

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2024 18:43

Sharing

Report Analysis Logs

General

Target

51513aad3dd3a3cf5794983a4266f896.dll
Size

31KB
MD5

51513aad3dd3a3cf5794983a4266f896
SHA1

548a264ad6038553427ee5967075f29ede74815a
SHA256

694d262d2fb5e8566764bc7cd5ed15cd56be8591cac1634139758dd712a60d58
SHA512

9b2bf303ee872162dad1e28dfd53425e39772e36641892b2013682e8be0e2089f254ff061ca6d0535dd740ee1f5c6e0a1bc52b592b182cac093782b5733a8919
SSDEEP

768:Eufkh+tB7dNyJwD/zqNL5N07Cek4bgF4m4n9iX:Eufk2fNba3euim09

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 3076	2320	rundll32.exe	43
PID 2320 wrote to memory of 3076	2320	rundll32.exe	43
PID 2320 wrote to memory of 3076	2320	rundll32.exe	43

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\51513aad3dd3a3cf5794983a4266f896.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\51513aad3dd3a3cf5794983a4266f896.dll,#1
  2⤵
  PID:3076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads