dd45619bbe7fc8a44fc4c7cd560fe5d472803ecf3ea0f7ab407c35ea8f0eef40 | Triage

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 00:28

Sharing

Report Analysis Logs

General

Target

95c54da4db15f727a89d90ecfd892723.dll
Size

136KB
MD5

95c54da4db15f727a89d90ecfd892723
SHA1

c691cac0c97b129f0441d5d9433b639ee2432df2
SHA256

dd45619bbe7fc8a44fc4c7cd560fe5d472803ecf3ea0f7ab407c35ea8f0eef40
SHA512

01dadec015540a2efedbffb2fe2f432a8ab90134c5cb4df5f8e99c5531a4b4aa6ce3a0ee03cb226431fd8f5f01d1e0d64da59fcb62b09b676588335f783bfe26
SSDEEP

3072:j9e8vJBYLLcvHiTUlUOmR5pC/3r8yJonyk:jM4m3UH2vE8/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 4932	4724	rundll32.exe	85
PID 4724 wrote to memory of 4932	4724	rundll32.exe	85
PID 4724 wrote to memory of 4932	4724	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\95c54da4db15f727a89d90ecfd892723.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\95c54da4db15f727a89d90ecfd892723.dll,#1
  2⤵
  PID:4932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads