fff91b67cd6f1304f8d6d590fbafa74cfb25540e22715403b342b5f48cbca726 | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b4d0b3f62d362073a9f24738e41f0adb.dll
Size

224KB
MD5

b4d0b3f62d362073a9f24738e41f0adb
SHA1

455ff0024a11b4da9e1f72454b17cb208708b06e
SHA256

fff91b67cd6f1304f8d6d590fbafa74cfb25540e22715403b342b5f48cbca726
SHA512

e744e3bc18b3e176102733ecd4643e456503342805cb5c54ac04baf6186fdb051680c0a618ceaa349785e7b2b2b342172d07fc145898b839e159c8f1dbe828b3
SSDEEP

6144:L8PsHLHMjg1W0AC60htNlenz2F+I2Ydpn9:L+sHLHMjg1W0AC60hMnz2Fr2s9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 5116	2788	rundll32.exe	88
PID 2788 wrote to memory of 5116	2788	rundll32.exe	88
PID 2788 wrote to memory of 5116	2788	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4d0b3f62d362073a9f24738e41f0adb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4d0b3f62d362073a9f24738e41f0adb.dll,#1
  2⤵
  PID:5116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads