b8cb661ff6b8dd7be850a9ac2594a6bec1ad468316a8254470ff062112b64910 | Triage

Analysis

max time kernel
1463s
max time network
1480s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
22-03-2024 06:02

Sharing

Report Analysis Logs

General

Target

XInput9_1_0.dll
Size

11KB
MD5

d61fd9bf10f59713082cfc9a3accbf87
SHA1

d36a0129c846be9bd2a79af82a5a9af199f84ed8
SHA256

0222e64dc51dc14095e453b46b485834b0c81ae8ced850e7e7b52acf11bb723e
SHA512

595e73710bb567fd8be0ac130aac6334ae34bddca3e39c34322c7390947152d15a8717d30a6e923c6d48390312f42501f29436d6c73be59ed086d26362921c3d
SSDEEP

192:TQdcdW6Ss9HI23vSdZXShyWJT/BEaE+EgwijOyKaCwmPgbDLTGc:f/SspI2WgHJZlj/Ka/tvi

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2512 wrote to memory of 3940	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 3940	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 3940	2512	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XInput9_1_0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XInput9_1_0.dll,#1
2⤵
PID:3940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads