12854a3e6ddb63358165183810f5ffde23c9cb87c78909e143bfc06178d524e6 | Triage

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

aaee25acb7f04c74c71b8e40aab25c7a.dll
Size

840KB
MD5

aaee25acb7f04c74c71b8e40aab25c7a
SHA1

62a5530eb27c5a713b0ccdb0acbf6257352ea499
SHA256

12854a3e6ddb63358165183810f5ffde23c9cb87c78909e143bfc06178d524e6
SHA512

304a5473cb8448231a6395d738b28c5979cf1ced4066c03fb82a7a25bd758023d3372f9cbb96df2daa6026d1e007231da5b828c8e7569748d3bbffe001301e1a
SSDEEP

24576:waaSp+ft7Kdo0iu0wAcJ2ZjnyUcOkFHDzqV:xaSkfYyRwjaqJDOV

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 3264	3172	rundll32.exe	86
PID 3172 wrote to memory of 3264	3172	rundll32.exe	86
PID 3172 wrote to memory of 3264	3172	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aaee25acb7f04c74c71b8e40aab25c7a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aaee25acb7f04c74c71b8e40aab25c7a.dll,#1
  2⤵
  PID:3264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads