40d7cf98bf2a73fc8cae938784d25bd4e327081d98ee3942c57fd68f277569c7 | Triage

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2024 06:49

Sharing

Report Analysis Logs

General

Target

8e7d7889d133137d9f005e3fde16c4b8.dll
Size

1.1MB
MD5

8e7d7889d133137d9f005e3fde16c4b8
SHA1

2c1907b6adb2cd2c79cde93f4c6f353acedaf75a
SHA256

40d7cf98bf2a73fc8cae938784d25bd4e327081d98ee3942c57fd68f277569c7
SHA512

f92908fdb8831358f0a9631ffa760a2c955c6518c561ad97d7911dabd7659b19a06428162c64416c57bfb71a27adaf9a3c46c4763d7ec8dbac6555d517884dbb
SSDEEP

24576:0UWfkT753Cx8yHNePbGCBWSz6YoPqaIvufnX:0bGCxrHHC4Soq98

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 3868	4944	rundll32.exe	45
PID 4944 wrote to memory of 3868	4944	rundll32.exe	45
PID 4944 wrote to memory of 3868	4944	rundll32.exe	45

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e7d7889d133137d9f005e3fde16c4b8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e7d7889d133137d9f005e3fde16c4b8.dll,#1
  2⤵
  PID:3868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3868-0-0x00000000021A0000-0x000000000233B000-memory.dmp

Filesize
1.6MB

Download