64d6d9d6bb9ce147a8e024df9a5d9df80fecbfacf922a40078f07ab40cd7a5e5 | Triage

Analysis

max time kernel
89s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 01:38

Sharing

Report Analysis Logs

General

Target

95e6893eaee46d576e88b0f0229d6182.dll
Size

88KB
MD5

95e6893eaee46d576e88b0f0229d6182
SHA1

2669dcb4f548290ca6b94c6c819d6bf02ac8ae92
SHA256

64d6d9d6bb9ce147a8e024df9a5d9df80fecbfacf922a40078f07ab40cd7a5e5
SHA512

6fca813363f940dd355828bcb155ebca4349e295eebe1e428f9b33c5090e32cc7378815337b0ba6b7c9e83c6645248b857e60a591ffb798378bd1162fbcc5ab2
SSDEEP

1536:xXZTsRhrXQiDkUVWCcZ0HdIc+N0qeGj4IeB:xXZIh7QiDkqyZ0uN0qeGjfY

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2016	2280	rundll32.exe	84
PID 2280 wrote to memory of 2016	2280	rundll32.exe	84
PID 2280 wrote to memory of 2016	2280	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\95e6893eaee46d576e88b0f0229d6182.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\95e6893eaee46d576e88b0f0229d6182.dll,#1
  2⤵
  PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-0-0x0000000000D90000-0x0000000000D9D000-memory.dmp

Filesize
52KB

Download
memory/2016-2-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2016-5-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2016-6-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download