866f534d2142047f0b8b1e0edf96c56eee37009f1d2d033562056e7e8289a53b | Triage

Analysis

max time kernel
150s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 23:02

Sharing

Report Analysis Logs

General

Target

c45489117dae223d6c8deb5b25c20960.dll
Size

140KB
MD5

c45489117dae223d6c8deb5b25c20960
SHA1

6faaf0bce99c54a21eea380b95dce5af575652b0
SHA256

866f534d2142047f0b8b1e0edf96c56eee37009f1d2d033562056e7e8289a53b
SHA512

2a46fb48671d5479451ee95ed190e20b763e334051ae61e3623341b2da7504b0605c61c0d1073b77bf051b82259fe605fa296ddd16e36f3012d168491a79532a
SSDEEP

3072:m9twa4n8uoZEGPpRp5fjk3LF2mawomBt:m9yxoZEUpWF2mawnt

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 3000	436	rundll32.exe	88
PID 436 wrote to memory of 3000	436	rundll32.exe	88
PID 436 wrote to memory of 3000	436	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c45489117dae223d6c8deb5b25c20960.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c45489117dae223d6c8deb5b25c20960.dll,#1
  2⤵
  PID:3000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3000-0-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/3000-1-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download