87ea69570136c63736d95fd3950e11c67fd37ab1053410bc9e4aca66805a4cd9 | Triage

Analysis

max time kernel
313s
max time network
1598s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
22-03-2024 06:40

Sharing

Report Analysis Logs

General

Target

XInput9_1_0.dll
Size

11KB
MD5

c5fe86cc2025ea38f5b4a584d99d6c4f
SHA1

eb6135c4751761ccafaee78e884207686eccd94d
SHA256

9018ab4c056298b1fe30103b13f1d762c7048e83d1730893dcbf2294bbb73269
SHA512

58294c13e04a8c3956e0bdd97a0f087dcf4b12be3a7970b5b1837a8dc760e0719c8774cd88c6ecaac74a7dda6177fa3a8653ab7505c38fa396905e4aaeabb559
SSDEEP

192:XQdcdW6Ss9HI23vSdZXShyWJT/BEaE+EgwijOymaCwmPgbDLTGc:j/SspI2WgHJZlj/ma/tvi

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1236 wrote to memory of 4452	1236	rundll32.exe	rundll32.exe
PID 1236 wrote to memory of 4452	1236	rundll32.exe	rundll32.exe
PID 1236 wrote to memory of 4452	1236	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XInput9_1_0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1236

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XInput9_1_0.dll,#1
2⤵
PID:4452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...