a096845d6c5f7ca8a131768cbe86b57fb70c39612110ad819617117e9b08a1ae | Triage

Analysis

max time kernel
141s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 00:17

Sharing

Report Analysis Logs

General

Target

System.Collections.NonGeneric.dll
Size

94KB
MD5

d9af7be6e5ede98e59580a6e3995ff04
SHA1

14042b8741d5ccf540a6425d9847c20f0cd79bfe
SHA256

55347653b204516ba3feb26f9e38348982d141bc2654470c74cd6672f2f5fe47
SHA512

fa9d407f39d8a095d59d4de20a0057c732232dab03c0b91d6396b0902c467370a5ba0ca12dd422e2d334628e31082cf464f169b60d7d26352f6836f32d6b4e9b
SSDEEP

1536:XhrldoYSDLdsNnQ0VxQs7uzZqie8DK9BTYhYi49zm:Xh/oZHGNQYezZqZkKkhKy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 4816	2824	rundll32.exe	82
PID 2824 wrote to memory of 4816	2824	rundll32.exe	82
PID 2824 wrote to memory of 4816	2824	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.Collections.NonGeneric.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.Collections.NonGeneric.dll,#1
  2⤵
  PID:4816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads