58ab2f11d6c5289c2b255885a5ebe681288fd8b97f0c9621d0b8a6616becd178 | Triage

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 13:11

Sharing

Report Analysis Logs

General

Target

cb7eed08608903b7117e2486758a8491.dll
Size

36KB
MD5

cb7eed08608903b7117e2486758a8491
SHA1

75bd268913369185978f3c034e9c9be1ebd8d96f
SHA256

58ab2f11d6c5289c2b255885a5ebe681288fd8b97f0c9621d0b8a6616becd178
SHA512

1acd2a2b112c6d8eb00ccb4e1b5bde8e0ea6ce6ac963b8b93f4ae4380574db4271e86d10e35d93e6690d200c618720ad6ea53f1ff1c3862143dc2c5ebd96a893
SSDEEP

768:eRoftihkMWdd+rEUm5c41DBBQARQkRXFwfwo:QsqkDn+rEUWTBBQARBMwo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 4292	224	rundll32.exe	89
PID 224 wrote to memory of 4292	224	rundll32.exe	89
PID 224 wrote to memory of 4292	224	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb7eed08608903b7117e2486758a8491.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb7eed08608903b7117e2486758a8491.dll,#1
  2⤵
  PID:4292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads