3bebb7380c6abf4812e33288301aef099a62ba4a5f13542d253d3353e53f26a6 | Triage

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 07:20

Sharing

Report Analysis Logs

General

Target

d5883ee1954de088d8cc4a45638485cd.dll
Size

220KB
MD5

d5883ee1954de088d8cc4a45638485cd
SHA1

21bb1d43b1ed87b9e4c4b5ea72bbb121c7cd2cf2
SHA256

3bebb7380c6abf4812e33288301aef099a62ba4a5f13542d253d3353e53f26a6
SHA512

cf67b5d3a651e03d5dc01e68d39a276a13ccebf2cfc48b24265663735927a6fed2f880c523784ee29dcf0dab35097d0cc176de8356e48e0308979d44f9c5e71a
SSDEEP

768:ld4Xvua1kKQBQQyYqui2CBBQARQk4jnXEACT:H4X2aWKQJXi2CBBQARInwT

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 1068	4188	rundll32.exe	88
PID 4188 wrote to memory of 1068	4188	rundll32.exe	88
PID 4188 wrote to memory of 1068	4188	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d5883ee1954de088d8cc4a45638485cd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d5883ee1954de088d8cc4a45638485cd.dll,#1
  2⤵
  PID:1068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads