cf0390fce2622ca649704463c1a7840007f85ac456c7b30143ce2be69c859194 | Triage

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 13:19

Sharing

Report Analysis Logs

General

Target

d6371501796b46be1046c13f7fa17f95.dll
Size

88KB
MD5

d6371501796b46be1046c13f7fa17f95
SHA1

afeebf99e0c11fdcf9828b42ee77ab909e2b3c77
SHA256

cf0390fce2622ca649704463c1a7840007f85ac456c7b30143ce2be69c859194
SHA512

5c98793ca62307016d6bb40ffae59f62b32b0ff7e2857cc6aa02325c392eb15c9ac2ea45a15b38e05156cd81b0c200cd31450340af01bcf9e397792f4c7b4a33
SSDEEP

1536:SicjQWlBGmCj3CA1rPFW122smkjTP0z2eWLnhK6ba:SicjQwB2jPrPrT8yeSva

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 772	3700	rundll32.exe	88
PID 3700 wrote to memory of 772	3700	rundll32.exe	88
PID 3700 wrote to memory of 772	3700	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6371501796b46be1046c13f7fa17f95.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6371501796b46be1046c13f7fa17f95.dll,#1
  2⤵
  PID:772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/772-0-0x0000000000DA0000-0x0000000000DB5000-memory.dmp

Filesize
84KB

Download
memory/772-1-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download
memory/772-3-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download