99c9aa8190b79eee69b124140d11c5f80789fe4333b3b941b57d079b25b28c7e | Triage

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 13:29

Sharing

Report Analysis Logs

General

Target

9bcd0d688185aba1ff6691b55b147bb7.dll
Size

16KB
MD5

9bcd0d688185aba1ff6691b55b147bb7
SHA1

adff4a1a074ca511af7cbe16081a9b9732640a80
SHA256

99c9aa8190b79eee69b124140d11c5f80789fe4333b3b941b57d079b25b28c7e
SHA512

848cad6c7e363d2435e35c670ce7faa40db354f258f724f438650a869bf14f304902dceaa62f06e133135e7cf1843e45b9a6af849eb9218caec92a5be614c558
SSDEEP

384:r6k7GoHngcQgVVfv1S2VGo6OpWaIniuxMI2:rf7NHgcQexVOnim0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 2472	4968	rundll32.exe	84
PID 4968 wrote to memory of 2472	4968	rundll32.exe	84
PID 4968 wrote to memory of 2472	4968	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bcd0d688185aba1ff6691b55b147bb7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bcd0d688185aba1ff6691b55b147bb7.dll,#1
  2⤵
  PID:2472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2472-0-0x0000000002130000-0x0000000002136000-memory.dmp

Filesize
24KB

Download