b8cb661ff6b8dd7be850a9ac2594a6bec1ad468316a8254470ff062112b64910 | Triage

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-02-2024 18:13

Sharing

Report Analysis Logs

General

Target

XInput9_1_0.dll
Size

11KB
MD5

d61fd9bf10f59713082cfc9a3accbf87
SHA1

d36a0129c846be9bd2a79af82a5a9af199f84ed8
SHA256

0222e64dc51dc14095e453b46b485834b0c81ae8ced850e7e7b52acf11bb723e
SHA512

595e73710bb567fd8be0ac130aac6334ae34bddca3e39c34322c7390947152d15a8717d30a6e923c6d48390312f42501f29436d6c73be59ed086d26362921c3d
SSDEEP

192:TQdcdW6Ss9HI23vSdZXShyWJT/BEaE+EgwijOyKaCwmPgbDLTGc:f/SspI2WgHJZlj/Ka/tvi

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 372 wrote to memory of 4992	372	rundll32.exe	rundll32.exe
PID 372 wrote to memory of 4992	372	rundll32.exe	rundll32.exe
PID 372 wrote to memory of 4992	372	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XInput9_1_0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:372

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XInput9_1_0.dll,#1
2⤵
PID:4992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads