5822d4e1961423a7a17f0dd8aeedcc9c26e59eb289005e0d784d5cbb78e45ab4 | Triage

Analysis

max time kernel
136s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6510838524864912acecccf13d3fed49.dll
Size

248KB
MD5

6510838524864912acecccf13d3fed49
SHA1

3cd1189f433be8e9cd7417e89def7bf3dcef5dcd
SHA256

5822d4e1961423a7a17f0dd8aeedcc9c26e59eb289005e0d784d5cbb78e45ab4
SHA512

0b184fb66fb352d65eafcb8b84edfcf93baaec26064b5eaf7612c15a735866a9d425a594d36f4a32aad93a43bd5a2fa09cc49f45768cc7ecd07b85768f40e98a
SSDEEP

6144:aliSq/1PSm2sQPkgCyoHVvdnf5CVE1oPb:alnq1EsQahHRdnIgoD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 3364	1980	rundll32.exe	16
PID 1980 wrote to memory of 3364	1980	rundll32.exe	16
PID 1980 wrote to memory of 3364	1980	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6510838524864912acecccf13d3fed49.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6510838524864912acecccf13d3fed49.dll,#1
  2⤵
  PID:3364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3364-0-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download