a831ab76dcd785734393b7f95d84a7ac6682823bcd4886560b2b4c1782b82709 | Triage

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30-01-2024 02:12

Sharing

Report Analysis Logs

General

Target

Accessibility.dll
Size

10KB
MD5

1b4cc6782e295675217cd17df70057f3
SHA1

f468087e7fbaa5aeed1fc41062b198570ae017e3
SHA256

f08bdbf797dfdbbde37000fb29141caec4beb4dc0f552ab2cfe0887e1e6c5f60
SHA512

05289e9514d173694a1e15dc5228976c963572353c78412bc79bdc933ae89df08e889736232c6240e4fa1e8f26689cb4eeae4a83aa9e333a6d1882b8b857a8fb
SSDEEP

192:qN1WRFlDWlolDWlIJh2ICtMBYY5IQY2xLnG63etbTWm/W:+1UlqlolqlIWGPISLGptXWm/W

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5540 wrote to memory of 232	5540	rundll32.exe	16
PID 5540 wrote to memory of 232	5540	rundll32.exe	16
PID 5540 wrote to memory of 232	5540	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Accessibility.dll,#1
1⤵
PID:232

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Accessibility.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads