4e39cec3cae46e68b08dd620b703d5fc9038b9bb4b72b63e240ba90a97ce4ab8 | Triage

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24-02-2024 21:38

Sharing

Report Analysis Logs

General

Target

a2cde4b5208fa43994522cc74e777d71.dll
Size

48KB
MD5

a2cde4b5208fa43994522cc74e777d71
SHA1

3149928fea5b50a265f5ac57409b2ca809d3757f
SHA256

4e39cec3cae46e68b08dd620b703d5fc9038b9bb4b72b63e240ba90a97ce4ab8
SHA512

6bdad9846365447e7be8d0b1239f0c9df58b012ec08c276d7df63fbeffb91e94c477af5629a5fa471409163cc8925ee269664fb7e091478a076bbee839cd6e2c
SSDEEP

768:Ah5S4S2g8eNKmbkMbwkSGHy7XdkTmZfDquTb:AbbS1NKUkMbwXGuyTyDqu

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2724	rundll32.exe
2724	rundll32.exe
2724	rundll32.exe
2724	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 2724	1216	rundll32.exe	40
PID 1216 wrote to memory of 2724	1216	rundll32.exe	40
PID 1216 wrote to memory of 2724	1216	rundll32.exe	40

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a2cde4b5208fa43994522cc74e777d71.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a2cde4b5208fa43994522cc74e777d71.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads