33a1c7f4799b940d2a1e9766e4b37cb298f40377982ac4773443dd500aaf085e | Triage

Analysis

max time kernel
93s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f0000034.dll
Size

24KB
MD5

f40063e7721fd57fe962bc6287ad75e6
SHA1

619046dbf22b2915e1737f883736374005264521
SHA256

76429c10f359a976e3c446334bb69bec9d4ca50d14177cfa07f02b9b578090be
SHA512

1d4d331afcfef9276d0c5a00466c947c5d70832ce7a15ec39ae60d8f157b36c75ceffdc727ef04abacef330170f17cbb27d7bf427e36b68784914d1278c4bdbd
SSDEEP

384:OHWPF2lCu4QZdoPVxOI1ZJr6KOtFY6D3RDuHGyJznVZWRnh5oU:1PFiZ4MuyIzJr6KW5D3RDSJrsgU

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 2836	1456	rundll32.exe	74
PID 1456 wrote to memory of 2836	1456	rundll32.exe	74
PID 1456 wrote to memory of 2836	1456	rundll32.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0000034.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0000034.dll,#1
  2⤵
  PID:2836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads