a974ed473fd6e8ed868dc4e1599f26c211daa1908cc67a446308da314d8f4feb | Triage

Analysis

max time kernel
140s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 21:38

Sharing

Report Analysis Logs

General

Target

97aaad182af6b1bcb3071abaaff36457.dll
Size

13KB
MD5

97aaad182af6b1bcb3071abaaff36457
SHA1

54ce97cb8a0a963359f471483c2589f1c4ba406f
SHA256

a974ed473fd6e8ed868dc4e1599f26c211daa1908cc67a446308da314d8f4feb
SHA512

0811af35a5ec8d6a2fa735722fc7065f0ecff4765d11af4b870aa2a44b1cd5a488e786561f2b1951d749fbf83d506296dd6db4c4006ff4c97a95322ccf76e256
SSDEEP

384:NKHrSXpYbhQa5cyoaFFVuqbbJ+ujzlm+M7iS:kHrSXz6caFjvXYEXA

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 224	3924	rundll32.exe	84
PID 3924 wrote to memory of 224	3924	rundll32.exe	84
PID 3924 wrote to memory of 224	3924	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\97aaad182af6b1bcb3071abaaff36457.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\97aaad182af6b1bcb3071abaaff36457.dll,#1
  2⤵
  PID:224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads