ca5f548bf325567290e67542ebc88c1975d6972d06d5116b79ea7a9949e2e3e7 | Triage

Analysis

max time kernel
120s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18-01-2024 01:58

Sharing

Report Analysis Logs

General

Target

642f001fd8e67c4e9801912894caa45d.dll
Size

135KB
MD5

642f001fd8e67c4e9801912894caa45d
SHA1

e44cc9915e555bed301bb9d0caa3f56243ac57db
SHA256

ca5f548bf325567290e67542ebc88c1975d6972d06d5116b79ea7a9949e2e3e7
SHA512

aa23156f4c9ce8526ae170f07be885a02beccc88d8ca879109bd937c007d75f33ac3cd53756422b60c1ddedc2b75b96b47f62a7cc50b0f61e1a48ebc223f00ec
SSDEEP

768:qySde919vTMfARpZJKT9Ut4OlDtHLhph5:qyS07uARpKEhtr

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 4120	1492	rundll32.exe	86
PID 1492 wrote to memory of 4120	1492	rundll32.exe	86
PID 1492 wrote to memory of 4120	1492	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\642f001fd8e67c4e9801912894caa45d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\642f001fd8e67c4e9801912894caa45d.dll,#1
  2⤵
  PID:4120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads