7c3330cc735da22d8eeff91f160c6d17b3a1a6bfca6ff0de95c5694623aaeea0 | Triage

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 02:17

Sharing

Report Analysis Logs

General

Target

9a807f297aa656460b3872d11586cda7.dll
Size

16KB
MD5

9a807f297aa656460b3872d11586cda7
SHA1

438a3e9782bdcceda7dcc3f57a0c132a18ab34b3
SHA256

7c3330cc735da22d8eeff91f160c6d17b3a1a6bfca6ff0de95c5694623aaeea0
SHA512

717fff32097c700b884f91ea01a15841d34525bdea138f03767de29906c79cdd8d1fe58e734cb43b697bed7b2a152997afdf5c9643be84cb5ec903f98e1cfee7
SSDEEP

384:FGmUaW2qYCtgEmPKWZ7uBBQARQknNn1mmVq:FGYRwBBQARQkN1mm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 2912	4696	rundll32.exe	84
PID 4696 wrote to memory of 2912	4696	rundll32.exe	84
PID 4696 wrote to memory of 2912	4696	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a807f297aa656460b3872d11586cda7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a807f297aa656460b3872d11586cda7.dll,#1
  2⤵
  PID:2912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads