5b4e091f4ff55c2d426ca3ab68714562387fb615b820bb32dd696a150f3330cd | Triage

Analysis

max time kernel
146s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
13-01-2024 04:57

Sharing

Report Analysis Logs

General

Target

sni.dll
Size

133KB
MD5

c62a83f20bc23aeface70ec13003c4c5
SHA1

35553cfcdcbeccdc49710e68aec495c16880f0bd
SHA256

1446d6b26da49a5a9f366972f89f4e236f916955f31ddc38ebb96217c1cace9c
SHA512

4dda44fd5b538f5da9e8cb46a3ab1bdc14b43425b9a61249eccc925d986af7b8b3548db9490238f14807909ecf479415117141ddb344119438a59f97e894ea37
SSDEEP

3072:H3SGhrfrdqCn3bctzdGRX18u5e++dowahamD5/f+vHPoW:H3SGhbBqCnmzERyiepSUm9moW

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 5008	3192	rundll32.exe	18
PID 3192 wrote to memory of 5008	3192	rundll32.exe	18
PID 3192 wrote to memory of 5008	3192	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sni.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\sni.dll,#1
  2⤵
  PID:5008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads