06da1fcccf3d6cbd6ba0e69b84bd5cc612d301dc2f007d28b321e9838256a1fc | Triage

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2024 06:30

Sharing

Report Analysis Logs

General

Target

8e74c0f72dc9a1f6d9aae8ddc8332c01.dll
Size

50KB
MD5

8e74c0f72dc9a1f6d9aae8ddc8332c01
SHA1

6da7022ed8074c32534b0fa981d96b3a8641b611
SHA256

06da1fcccf3d6cbd6ba0e69b84bd5cc612d301dc2f007d28b321e9838256a1fc
SHA512

9e88057159c14251d338d579c929c46a92797761ded529e3b888608c47eadaa125db1edc5246dd100a5173628114fd4f4e256e7639d560017852c07a78db9834
SSDEEP

1536:Yb60MNuRKVQEXvswEjgdiLMA+MzrM/qOdbT7aRG4V:Y+0wuRMQe0yhcAVH4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 3112	1520	rundll32.exe	85
PID 1520 wrote to memory of 3112	1520	rundll32.exe	85
PID 1520 wrote to memory of 3112	1520	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e74c0f72dc9a1f6d9aae8ddc8332c01.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e74c0f72dc9a1f6d9aae8ddc8332c01.dll,#1
  2⤵
  PID:3112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3112-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download