5b4e091f4ff55c2d426ca3ab68714562387fb615b820bb32dd696a150f3330cd | Triage

Analysis

max time kernel
142s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20231222-en
resource tags

arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system
submitted
13-01-2024 04:57

Sharing

Report Analysis Logs

General

Target

ucrtbase.dll
Size

1.1MB
MD5

6343ff7874ba03f78bb0dfe20b45f817
SHA1

82221a9ac1c1b8006f3f5e8539e74e3308f10bcb
SHA256

6f8f05993b8a25cadf5e301e58194c4d23402e467229b12e40956e4f128588b3
SHA512

63c3d3207577d4761103daf3f9901dd0a0ae8a89694ad1128fd7e054627cdd930d1020049317c5a898411735e2f75e2103ae303e7e514b6387a3c8463a4fb994
SSDEEP

24576:Os974wcfeCepgb9qqu+XMO4nXIzvQVbe1SmcvIZPoy4/ZBVX:b96WghMOqI8Vbe1GZBVX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 1700	4084	rundll32.exe	16
PID 4084 wrote to memory of 1700	4084	rundll32.exe	16
PID 4084 wrote to memory of 1700	4084	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll,#1
1⤵
PID:1700

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads