06ce4c1421bdccfe8d7246807747423da2b17d2812282c857c43d38aab7b2abd | Triage

Analysis

max time kernel
89s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 13:06

Sharing

Report Analysis Logs

General

Target

b4c3c8d3e3e62218d157c2dbdd4ee7c2.dll
Size

64KB
MD5

b4c3c8d3e3e62218d157c2dbdd4ee7c2
SHA1

b523d334c109620c48f2f2df44cd322cb9ccde81
SHA256

06ce4c1421bdccfe8d7246807747423da2b17d2812282c857c43d38aab7b2abd
SHA512

86073070145d56880a2dd1501312cdbcee03c028a521c36be7f93d507c8c6a45e345c0937f1a64766df951d0e4244fecf4f3a18e24b869ed7c88c314b3b05657
SSDEEP

1536:WjXRlJTILsc9EL+appNcvETXtDifLzcC:AXR/ILsc9g+app6vETd+TX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 3476	4284	rundll32.exe	88
PID 4284 wrote to memory of 3476	4284	rundll32.exe	88
PID 4284 wrote to memory of 3476	4284	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4c3c8d3e3e62218d157c2dbdd4ee7c2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4c3c8d3e3e62218d157c2dbdd4ee7c2.dll,#1
  2⤵
  PID:3476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3476-0-0x0000000001020000-0x0000000001028000-memory.dmp

Filesize
32KB

Download