fa986f9828e0e1ab0659854a78e68653b5dd762ab38c3b4e6add735312b23df6 | Triage

Analysis

max time kernel
90s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 21:17

Sharing

Report Analysis Logs

General

Target

97a037528fabd4a515d7d594570bc02b.dll
Size

302KB
MD5

97a037528fabd4a515d7d594570bc02b
SHA1

f7da626c38949d77bc11351410a5d9ca82c51dac
SHA256

fa986f9828e0e1ab0659854a78e68653b5dd762ab38c3b4e6add735312b23df6
SHA512

eaf7952535da1ac88ce369d2d19ad07f7b6398dbac4a2aef8d9eb79bbf438d6afd1f2f7b3e5b0c6be825baf53927d669bd4d5f906e47bb1988a6dbf691fa8bd3
SSDEEP

6144:l4yRZVLlfh7rZthO+JjkuHEEAt/wz/60ZEPC:+QZdfrXg+JwuKt/S/60Zq

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 2776	4040	rundll32.exe	85
PID 4040 wrote to memory of 2776	4040	rundll32.exe	85
PID 4040 wrote to memory of 2776	4040	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\97a037528fabd4a515d7d594570bc02b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\97a037528fabd4a515d7d594570bc02b.dll,#1
  2⤵
  PID:2776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads