90067454edaf71dcd57a2ce6381cf04066ad0890dc2978a364bcf3c6dd5463d1 | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 19:03

Sharing

Report Analysis Logs

General

Target

cc2f9ef2cfcddea91f6e9cb1a79ab05f.dll
Size

208KB
MD5

cc2f9ef2cfcddea91f6e9cb1a79ab05f
SHA1

c0bcd50409c18ffff5bda8a16776a69d4819dcfe
SHA256

90067454edaf71dcd57a2ce6381cf04066ad0890dc2978a364bcf3c6dd5463d1
SHA512

468b6187407e58c485eb507959aa527e19d5ea0bd7b2ff4ea69ce36b9a1470b7e67397b8a3d9afe78d42211f5424e263363f94c487239c55ed2bcfbcae9e6a04
SSDEEP

3072:EU/4FN9WkaWNh6fUlQftymH/RsAHZCQbuvvtzdCwX:xoObfsmygp1vSRL

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 4612	1524	rundll32.exe	89
PID 1524 wrote to memory of 4612	1524	rundll32.exe	89
PID 1524 wrote to memory of 4612	1524	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc2f9ef2cfcddea91f6e9cb1a79ab05f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc2f9ef2cfcddea91f6e9cb1a79ab05f.dll,#1
  2⤵
  PID:4612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads