d24de1adceadc3ddf8728b880003b78f595585b8278afd78c642ae08a894a9ef | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-03-2024 23:40

Sharing

Report Analysis Logs

General

Target

b5f374425734d7d889188c8fb7adf2b3.dll
Size

15KB
MD5

b5f374425734d7d889188c8fb7adf2b3
SHA1

ec75806b912a4747b19663be4850eb13a83cb9bb
SHA256

d24de1adceadc3ddf8728b880003b78f595585b8278afd78c642ae08a894a9ef
SHA512

58c06a17d2cad3d478f4524f83d250c7bedcc613502c0104965f8238bf36f76140dbcd3658c44335bb93b5d181381d77ac4076ab161fe92b8141485d8cc69fb3
SSDEEP

384:TxSDqRyY9pGT5SywikbuXIx3WetR0XqrZ:cY7Gd/whbBxGez0Xq

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 1968	3004	rundll32.exe	88
PID 3004 wrote to memory of 1968	3004	rundll32.exe	88
PID 3004 wrote to memory of 1968	3004	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5f374425734d7d889188c8fb7adf2b3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5f374425734d7d889188c8fb7adf2b3.dll,#1
  2⤵
  PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-0-0x00000000011C0000-0x00000000011C6000-memory.dmp

Filesize
24KB

Download
memory/1968-1-0x00000000011C0000-0x00000000011C6000-memory.dmp

Filesize
24KB

Download