b3a68a2c6e662e3728b4cd730bfbb0dbf13d1e48fb988092800776b213581627 | Triage

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 03:47

Sharing

Report Analysis Logs

General

Target

9865487b93c8c9d7f5a372008f560e01.dll
Size

14KB
MD5

9865487b93c8c9d7f5a372008f560e01
SHA1

d64fe9866e1dc7ca9bfc349c8f4efaffafb3a634
SHA256

b3a68a2c6e662e3728b4cd730bfbb0dbf13d1e48fb988092800776b213581627
SHA512

a2d05df6843cd97779eb9eb36877b19e5f07968d1bd1847afff10cabd6d82a35265f6190addeccfeb260a381edf93748ea508e296df3bdc7b4f701ebb807ef0a
SSDEEP

384:kOKUm6XOEvlLJaGa7Qa5AYAAhgjqWsNW:kl5XEvZ0Gc5AYnWjw

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2852	1976	rundll32.exe	84
PID 1976 wrote to memory of 2852	1976	rundll32.exe	84
PID 1976 wrote to memory of 2852	1976	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9865487b93c8c9d7f5a372008f560e01.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9865487b93c8c9d7f5a372008f560e01.dll,#1
  2⤵
  PID:2852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2852-0-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download