ecfd5c034390dbba918e72fca9b5e6f7cca211de8dab7c80de330ec64cca5614 | Triage

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2024, 20:48

Sharing

Report Analysis Logs

General

Target

689b8c24f00a0bfe5442b236fc7a4316.dll
Size

6KB
MD5

689b8c24f00a0bfe5442b236fc7a4316
SHA1

8c7ad3fc4192fcaceb7fc735416d40808865a749
SHA256

ecfd5c034390dbba918e72fca9b5e6f7cca211de8dab7c80de330ec64cca5614
SHA512

d359bc83870624dc029c567678d822e20bd153fc21f8fde61322fc63ad9d96187093f09f72c12d54e7b9ad2889e7cf9bac2813280261a32982d8da40e5d0d97d
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0WB+BDq9J5SH:VDa9VUX9bQW2B+FqX5SH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 4968	5040	rundll32.exe	83
PID 5040 wrote to memory of 4968	5040	rundll32.exe	83
PID 5040 wrote to memory of 4968	5040	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\689b8c24f00a0bfe5442b236fc7a4316.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\689b8c24f00a0bfe5442b236fc7a4316.dll,#1
  2⤵
  PID:4968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads