596c594d6014b633accf20f21f6373eff1182be0e0596ee9e643b3b9c07eb335 | Triage

Analysis

max time kernel
90s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2024 04:30

Sharing

Report Analysis Logs

General

Target

7ee4a49f066b61c8d598c4a526f54ecb.dll
Size

106KB
MD5

7ee4a49f066b61c8d598c4a526f54ecb
SHA1

ff77630cb1f445324c92c7bd93ad10913dabde64
SHA256

596c594d6014b633accf20f21f6373eff1182be0e0596ee9e643b3b9c07eb335
SHA512

aa5df616326a3c594a0d8ad35036e79d73930ec9a2c3d57ee8cf1435abda829120b81179f54565a078c339d25912d44886c6caa03f652ae46295d9b8a3682f51
SSDEEP

3072:FJAmDLQbt8pJBgMyzKOw7Pk3oyOf46vtEkYT:FJAmD0bt8pJBfD/yOf4Utvc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 3980	4204	rundll32.exe	83
PID 4204 wrote to memory of 3980	4204	rundll32.exe	83
PID 4204 wrote to memory of 3980	4204	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ee4a49f066b61c8d598c4a526f54ecb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ee4a49f066b61c8d598c4a526f54ecb.dll,#1
  2⤵
  PID:3980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads