eec41e374fc2c22e1ac64fcbd7c986aaf43edfef7683f828fb72c31256f9fb02 | Triage

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2024, 19:03

Sharing

Report Analysis Logs

General

Target

705229c50b8232cc8833c45aeededf52.dll
Size

536KB
MD5

705229c50b8232cc8833c45aeededf52
SHA1

35545f6479fbfbb1bfac7b569f107d87035bf3e7
SHA256

eec41e374fc2c22e1ac64fcbd7c986aaf43edfef7683f828fb72c31256f9fb02
SHA512

cbcb294d20ecf3231039f92ea9008ad3c8ed8dc5094460117638ca8f8066e19aa8f8e731d3d04a39b2c2ddc70da898daf09e2f2fc0843fb4fd74f7631397a0f4
SSDEEP

12288:DNXWNuMDtaIUXVpVvm7P5OrC2PODZ2cTVSA/Ay:D0AtnBmtODPOocTS

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 4612	2304	rundll32.exe	13
PID 2304 wrote to memory of 4612	2304	rundll32.exe	13
PID 2304 wrote to memory of 4612	2304	rundll32.exe	13

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\705229c50b8232cc8833c45aeededf52.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\705229c50b8232cc8833c45aeededf52.dll,#1
  2⤵
  PID:4612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4612-0-0x0000000001EF0000-0x0000000001F7E000-memory.dmp

Filesize
568KB

Download