d8ea2b5432775ec307541d6ff8a7b397a622f60ffd66c743e457bb46cc157fef | Triage

Analysis

max time kernel
90s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 04:25

Sharing

Report Analysis Logs

General

Target

Riched32.dll
Size

3KB
MD5

dc4f63e1905cba5e2b9f516e2c51fa50
SHA1

ea8b7f4c86eb45332cf49029955f62cb96bb7c34
SHA256

4566d63a9d4ccdb480e5d0186d7c7806463424d8fbb75a05bcff8051ee333e56
SHA512

7e0aaa076432fa66daa362f76ec24f201cdd4ccc607cc02a613e1e9d2cd60d63e90617c879be097725f3971cc5d7d6ebec0cae03cb5dc2d6e40c2a041e12a108

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 4936	4516	rundll32.exe	85
PID 4516 wrote to memory of 4936	4516	rundll32.exe	85
PID 4516 wrote to memory of 4936	4516	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Riched32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Riched32.dll,#1
  2⤵
  PID:4936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads