f2985be8166dd8539735f688462556351738841397ca738c5af32839cf4e3e30 | Triage

Analysis

max time kernel
125s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2024 12:11

Sharing

Report Analysis Logs

General

Target

897a840e2240fea58f3b5b7628e66d71.dll
Size

608KB
MD5

897a840e2240fea58f3b5b7628e66d71
SHA1

c342bbec4ee2161e00d46dae55d4e9ec7ce9c7b2
SHA256

f2985be8166dd8539735f688462556351738841397ca738c5af32839cf4e3e30
SHA512

f32cba1e1c0686dae2c54d0aabeaa507443d1474499c98fe7e2998229dd61aacfbea1fa425d92ded33664e6746629becea6bbc915a498df4ff0b117df57c04b2
SSDEEP

12288:YQW2AeXz4+GNGZIX/01c/unEIZUlxOnY7a+4:YQ5Ay4FNGZIPldIKxQXL

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
57	4892	rundll32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4892	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 4892	3044	rundll32.exe	84
PID 3044 wrote to memory of 4892	3044	rundll32.exe	84
PID 3044 wrote to memory of 4892	3044	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\897a840e2240fea58f3b5b7628e66d71.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\897a840e2240fea58f3b5b7628e66d71.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: RenamesItself
  PID:4892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads