d73880ce7ab17edb20ccd96a28cdb744371e82bea5f40c6e34015111f7efdfb3 | Triage

Analysis

max time kernel
151s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 11:20

Sharing

Report Analysis Logs

General

Target

5360c116f2c227ccd02c876b524dddd2.dll
Size

120KB
MD5

5360c116f2c227ccd02c876b524dddd2
SHA1

726b5f6a1c5fe8594a4ef0c2afc7522fffdf66ed
SHA256

d73880ce7ab17edb20ccd96a28cdb744371e82bea5f40c6e34015111f7efdfb3
SHA512

f48500905080ee0e839a9050648261dce19cb331e6db2a467a09abfa5614116314bee93a78f6a96d4943fc5c8a57cafe2c6430b6ca0e970ea1b70376647096eb
SSDEEP

3072:eIULnvwrfoF1FQcIdMj2xW5mI3rFbo99eMbCfXLmJx:eIG4rOQ59erpoUO0Cx

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 4140	2124	rundll32.exe	89
PID 2124 wrote to memory of 4140	2124	rundll32.exe	89
PID 2124 wrote to memory of 4140	2124	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5360c116f2c227ccd02c876b524dddd2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5360c116f2c227ccd02c876b524dddd2.dll,#1
  2⤵
  PID:4140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4140-0-0x0000000000CD0000-0x0000000000CDB000-memory.dmp

Filesize
44KB

Download
memory/4140-2-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download