b73369bc2eaaa9fe9fbdd711a0976eb035acfef02b89d73939b12f1a51a3c6fe | Triage

Analysis

max time kernel
90s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 06:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9af5b400ac7957016d9278142d5c7f9b.dll
Size

68KB
MD5

9af5b400ac7957016d9278142d5c7f9b
SHA1

3cdac08846e66627fd979878d1ba39628c3fc202
SHA256

b73369bc2eaaa9fe9fbdd711a0976eb035acfef02b89d73939b12f1a51a3c6fe
SHA512

ff465cdc5eb08894b4319543b5d5b5c599839c01a428b683f704fd8fe1d1aedfcd21f4a38e37358a2c626466ff039ae002ef48a27f97f7e597b9dd106cbf4938
SSDEEP

768:PIOGLxZGBzeirE7Rm1fJJFwLDYFnToIf1qu644XY:PSKVBE7A1fhkYFnToIfmN

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 5072	1852	rundll32.exe	83
PID 1852 wrote to memory of 5072	1852	rundll32.exe	83
PID 1852 wrote to memory of 5072	1852	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9af5b400ac7957016d9278142d5c7f9b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9af5b400ac7957016d9278142d5c7f9b.dll,#1
  2⤵
  PID:5072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads