59c8bfdfbb38ef399500c9de8d5bcf2c9fdad9a91eb83bba51b56e61610bfbb6 | Triage

Analysis

max time kernel
136s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 11:14

Sharing

Report Analysis Logs

General

Target

b89a81a40e519206d18f3dae809a8d1f.dll
Size

6KB
MD5

b89a81a40e519206d18f3dae809a8d1f
SHA1

9166acb523d35e51b6c5f899ad3085b89ebff099
SHA256

59c8bfdfbb38ef399500c9de8d5bcf2c9fdad9a91eb83bba51b56e61610bfbb6
SHA512

be571f7b9680bb340f05b22a997ed4fba650d0e7296d6ab96ad8ac496f87dd6d448e2c2d6b1dffa3142f44beaffd2d5262d90163f73e3f357283b6c7a2fea142
SSDEEP

48:6WQV5YVOqtV0H1pw9ygYVUG09B+BDq9J5SC:8qtV0HAr4IB+FqX5SC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 2440	4740	rundll32.exe	89
PID 4740 wrote to memory of 2440	4740	rundll32.exe	89
PID 4740 wrote to memory of 2440	4740	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b89a81a40e519206d18f3dae809a8d1f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b89a81a40e519206d18f3dae809a8d1f.dll,#1
  2⤵
  PID:2440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads