154866a180ae74fb215f0f43571a36d8d76f5bd1aacee041f07cf195b3b3508e | Triage

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15-01-2024 04:13

Sharing

Report Analysis Logs

General

Target

5c1ae50df5af6985c318835b21c9dcc2.dll
Size

1.2MB
MD5

5c1ae50df5af6985c318835b21c9dcc2
SHA1

ffd5d3e462bb5386d553d893a9c8f8c4b0bee3e3
SHA256

154866a180ae74fb215f0f43571a36d8d76f5bd1aacee041f07cf195b3b3508e
SHA512

aa269e5daf7f4f99adf8a291fe05e3bf514eae594f26824a54713f0d1294a5b04bc42bf6141a50063df4668b3709c8f933a457444fc3b5ea5532aa8a8e3bced8
SSDEEP

24576:6g4rMSieoTvfoBERV5TvSrw7l6EGw4kCrKs:6FriRDBVb4BkCrKs

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 3356	228	rundll32.exe	85
PID 228 wrote to memory of 3356	228	rundll32.exe	85
PID 228 wrote to memory of 3356	228	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c1ae50df5af6985c318835b21c9dcc2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c1ae50df5af6985c318835b21c9dcc2.dll,#1
  2⤵
  PID:3356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads