ef4b95bd5d62d42053648cd7143617cfb5596767b417560bcf0f77780c3512ae | Triage

Analysis

max time kernel
149s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 19:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

511e23f355c0733204418b1422303c28.dll
Size

252KB
MD5

511e23f355c0733204418b1422303c28
SHA1

188e739b92e4c97e6063e60537790aefb4bc01b5
SHA256

ef4b95bd5d62d42053648cd7143617cfb5596767b417560bcf0f77780c3512ae
SHA512

b60d49301ee16027897b8dc62f996d6a2ef63737ae6e65790f812ff423c41342d582cf6e79a8b5c6c9081285bed76d4238cf739a94c4ecfde917d8c52d2b0142
SSDEEP

6144:WzGFy6sI6ZunGpz57gPKVVTMRRI6PMxsU/8:CFv7VTCI6PMx8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 1508	3144	rundll32.exe	88
PID 3144 wrote to memory of 1508	3144	rundll32.exe	88
PID 3144 wrote to memory of 1508	3144	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\511e23f355c0733204418b1422303c28.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\511e23f355c0733204418b1422303c28.dll,#1
  2⤵
  PID:1508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads