a8b8c5af5a81e7539039bcde6c80428717724bfa84b8f081af4a91f530150b9a | Triage

Analysis

max time kernel
92s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 05:38

Sharing

Report Analysis Logs

General

Target

858c8921fd045dd5a185cd2135d30ee2.dll
Size

109KB
MD5

858c8921fd045dd5a185cd2135d30ee2
SHA1

cee7d814eff1f4239b54389afad56479405aa81f
SHA256

a8b8c5af5a81e7539039bcde6c80428717724bfa84b8f081af4a91f530150b9a
SHA512

861ff1281df64cea9a9d43c3f9967065e7e22347faeae2b918c136be65bc26a9629718992c921c29674a94729d1f2a951f45786fa25b2481417e0ae75b715220
SSDEEP

3072:G4uSD+ZwruS0bGYuZRtasSVh/QbIegRQod4l:VuTiabruZR8J1lD4l

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 372	3640	rundll32.exe	19
PID 3640 wrote to memory of 372	3640	rundll32.exe	19
PID 3640 wrote to memory of 372	3640	rundll32.exe	19

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\858c8921fd045dd5a185cd2135d30ee2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\858c8921fd045dd5a185cd2135d30ee2.dll,#1
  2⤵
  PID:372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads