0e9a1445941898c6962a8122ea7f05793516a2d7ae7d444ebfa463bff8854a51 | Triage

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 13:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8c69540b8cee01445be38861f43affe8.dll
Size

33KB
MD5

8c69540b8cee01445be38861f43affe8
SHA1

b4624cbb7438dd8ad83d1ea25706a5988e73a43d
SHA256

0e9a1445941898c6962a8122ea7f05793516a2d7ae7d444ebfa463bff8854a51
SHA512

21dbf01854a45e5f11b38fe3972522479c8271c75c08e8120c7480fd9aac4b8aad7027f7501b0c53ec9bd42f67d4a2de8966a5c5519140eb22bc47e08638b7a8
SSDEEP

768:pPwbjVmkNICtNeOoGVYMzhdzUfkmW0OL/QoIenTff:p4VmVUWGBptUoIO

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 1412	1528	rundll32.exe	84
PID 1528 wrote to memory of 1412	1528	rundll32.exe	84
PID 1528 wrote to memory of 1412	1528	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c69540b8cee01445be38861f43affe8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c69540b8cee01445be38861f43affe8.dll,#1
  2⤵
  PID:1412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1412-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download