5c8c5985ccadf49c31db958ab37bf9364bd9275501dd186c60eb62a5fee4b34b | Triage

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2024 06:23

Sharing

Report Analysis Logs

General

Target

Communicate.dll
Size

44KB
MD5

102b9fe06b7a8cad9af32737308cf707
SHA1

eb0743e1a849f5331ecf1ac8dc68c440f220fb0c
SHA256

d8c3c617831db57e6f8ab272dd9b2b9f7ea8002229c4df1a9db5d921e8c61876
SHA512

77c9cb2a93f8c8de06ea29ab28f8969cd2bafae0ff2aa594b6f60aaab30ff3b98fa87152ef9fa3f8a69426a9f4734ddcd82635cd49118f9781ef7bfde918bc8f
SSDEEP

768:UJd5AiLoDQ/4+TnGvippFxqWLCxfFHoUpw:UJd5AiP4+Tngip34thov

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 1124	3144	rundll32.exe	82
PID 3144 wrote to memory of 1124	3144	rundll32.exe	82
PID 3144 wrote to memory of 1124	3144	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Communicate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Communicate.dll,#1
  2⤵
  PID:1124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads