9ad8ea1ef30416a3ba33b00c33579d8bb714055d80269c684351cb4b7a1f94d1 | Triage

Analysis

max time kernel
136s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 20:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

51843134ee4f15fdf5525aa6f367cd1f.dll
Size

52KB
MD5

51843134ee4f15fdf5525aa6f367cd1f
SHA1

38ce0edcb3166b09f4233c8ad9cc27c11fd520b3
SHA256

9ad8ea1ef30416a3ba33b00c33579d8bb714055d80269c684351cb4b7a1f94d1
SHA512

86405e02abb1d7f644cae9c9e500349d917222c49150a09f0db83ad3f66f3745da9fbe82963ed3134323052af2b0509cf1f99c14f21f5a8775cdc57523056113
SSDEEP

1536:Qn3iVqNQqzNzKnOqTFlcFKpnxs4qmrKE:y/JzWTbSKpnxpKE

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 2780	1248	rundll32.exe	89
PID 1248 wrote to memory of 2780	1248	rundll32.exe	89
PID 1248 wrote to memory of 2780	1248	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\51843134ee4f15fdf5525aa6f367cd1f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\51843134ee4f15fdf5525aa6f367cd1f.dll,#1
  2⤵
  PID:2780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2780-0-0x00000000003B0000-0x00000000003C2000-memory.dmp

Filesize
72KB

Download