f918bb29b80d483bda278b6d233e9ed33e20a693d88f54a8929c65b172f13921 | Triage

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9b4c66375d43e6bc2bdb8a7014e0856b.dll
Size

132KB
MD5

9b4c66375d43e6bc2bdb8a7014e0856b
SHA1

e43e34dc2c2b6cd878be258631975634c79fa53f
SHA256

f918bb29b80d483bda278b6d233e9ed33e20a693d88f54a8929c65b172f13921
SHA512

14a3656cbf4b912da1bc7869dd515466170aa1203cc6e11b6d28ebe69d683f71e6f203f166eda00ded9084770a3bb84b49fee3a9353babb21c76432fd3cf9438
SSDEEP

768:u+14ea8S5WB/XjiX47pmAH87h/PwDdi3lYkXKK:u+1NVj37Kt3y2rKK

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 4204	3940	rundll32.exe	84
PID 3940 wrote to memory of 4204	3940	rundll32.exe	84
PID 3940 wrote to memory of 4204	3940	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b4c66375d43e6bc2bdb8a7014e0856b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b4c66375d43e6bc2bdb8a7014e0856b.dll,#1
  2⤵
  PID:4204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads