b8cb661ff6b8dd7be850a9ac2594a6bec1ad468316a8254470ff062112b64910 | Triage

Analysis

max time kernel
93s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
26-02-2024 12:55

Sharing

Report Analysis Logs

General

Target

XInput9_1_0.dll
Size

11KB
MD5

d61fd9bf10f59713082cfc9a3accbf87
SHA1

d36a0129c846be9bd2a79af82a5a9af199f84ed8
SHA256

0222e64dc51dc14095e453b46b485834b0c81ae8ced850e7e7b52acf11bb723e
SHA512

595e73710bb567fd8be0ac130aac6334ae34bddca3e39c34322c7390947152d15a8717d30a6e923c6d48390312f42501f29436d6c73be59ed086d26362921c3d
SSDEEP

192:TQdcdW6Ss9HI23vSdZXShyWJT/BEaE+EgwijOyKaCwmPgbDLTGc:f/SspI2WgHJZlj/Ka/tvi

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1588 wrote to memory of 1676	1588	rundll32.exe	rundll32.exe
PID 1588 wrote to memory of 1676	1588	rundll32.exe	rundll32.exe
PID 1588 wrote to memory of 1676	1588	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XInput9_1_0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1588

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XInput9_1_0.dll,#1
2⤵
PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads