a03744f35b77f3f73126c069a17ab2f7f3816a9d84e70d55cbd299502d33c7cd | Triage

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 14:06

Sharing

Report Analysis Logs

General

Target

726ff86fcfc6f6ce4f43bef683fe5639.dll
Size

17KB
MD5

726ff86fcfc6f6ce4f43bef683fe5639
SHA1

76094730855d5c1bd4e997b627b17280e1520e29
SHA256

a03744f35b77f3f73126c069a17ab2f7f3816a9d84e70d55cbd299502d33c7cd
SHA512

1b446378b255d02d6212ac26378a97b2942444c16c09ead85d417b2549dbc15d6b4f898fcd2604b1ee1bad2ec3d5d2b09a65e8502c2001a274edd2ff20ddac2a
SSDEEP

384:UTz5kfFoe6NFBWKnriuBBQARQkqMuo0d40:UKSNFHnrFBBQARQkKnd40

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 3096	3548	rundll32.exe	85
PID 3548 wrote to memory of 3096	3548	rundll32.exe	85
PID 3548 wrote to memory of 3096	3548	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\726ff86fcfc6f6ce4f43bef683fe5639.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\726ff86fcfc6f6ce4f43bef683fe5639.dll,#1
  2⤵
  PID:3096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads