d6d782c329653c5b050d64f3070a6a160d3d0aebd547f17720b4dba4110b859a | Triage

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e0d40ad84932f4948f31447e6f08549b.dll
Size

40KB
MD5

e0d40ad84932f4948f31447e6f08549b
SHA1

4f2f2f879e81fe66ebac653a1eb3e595ee48eb89
SHA256

d6d782c329653c5b050d64f3070a6a160d3d0aebd547f17720b4dba4110b859a
SHA512

092988dffe3916d4c8db9c77669833b7d65b288502055a5b82cd90b04de329044bb146e084222903d5cd04d86b09520007b6576618ea0a885fd5220f03d7cfd5
SSDEEP

768:blPHgFEwWZLvKzU7kAG7066tX+hP6jWBoRvc:blvg0KzUQn7066tuhyaoR0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 536	1300	rundll32.exe	90
PID 1300 wrote to memory of 536	1300	rundll32.exe	90
PID 1300 wrote to memory of 536	1300	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0d40ad84932f4948f31447e6f08549b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0d40ad84932f4948f31447e6f08549b.dll,#1
  2⤵
  PID:536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads