555cb2fd710da79f46f088b9fc79b541d8fec54239a71dd4e1be0c02fadd9eec | Triage

Analysis

max time kernel
151s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 22:14

Sharing

Report Analysis Logs

General

Target

598b3d1844f504953666de1e2da08609.dll
Size

12KB
MD5

598b3d1844f504953666de1e2da08609
SHA1

53f8c987794a7a8d6f3c90ab5ffb26ab092e9cdd
SHA256

555cb2fd710da79f46f088b9fc79b541d8fec54239a71dd4e1be0c02fadd9eec
SHA512

e619b4645097e98936e01a8e0d3f4ea36ace7efe46ef263c18441e4cb93bdbc6f93456f57386afb7da39731697715b8a59f73699ccbd30a1c86b2963bb3ecf1e
SSDEEP

384:f+4jYlbp4jjoj4gPADuJyeDAfKcg20xse/9ZN0:fAb66LpstfKZVse/9ZS

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
664	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 3600	5080	rundll32.exe	89
PID 5080 wrote to memory of 3600	5080	rundll32.exe	89
PID 5080 wrote to memory of 3600	5080	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\598b3d1844f504953666de1e2da08609.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\598b3d1844f504953666de1e2da08609.dll,#1
  2⤵
  PID:3600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3600-0-0x0000000025000000-0x000000002501A000-memory.dmp

Filesize
104KB

Download