99c2474f5bea6e3955d1002aa98678c32e9c0e9f2fb6d0c35d3a428ec279d103 | Triage

Analysis

max time kernel
141s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
13-01-2024 04:44

Sharing

Report Analysis Logs

General

Target

mscordbi.dll
Size

1002KB
MD5

0f5287ccf46af868d472a16dfada82f8
SHA1

96f9943dbdf240205de2a17c1c413ca3e0ac9b45
SHA256

776150b3c8008d9ef5d931ec871fc00638d81e3f5f37fe6cd4988353d6eaef25
SHA512

d0e993348577b7fa526d046bb684e449d82a40c0a1964f1714474d9711660eb9f83ef34e01c5fcf1089ab7c8400afce6d0e7946b5f278a08226cb46ad0afd2fa
SSDEEP

24576:O1tPRQ/bWmM1hPu16JeC2KInVt3qwUk/:bamM1hPu1meClInVt6wUk/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 4996	1108	rundll32.exe	14
PID 1108 wrote to memory of 4996	1108	rundll32.exe	14
PID 1108 wrote to memory of 4996	1108	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mscordbi.dll,#1
1⤵
PID:4996

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mscordbi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads