abf88f8275891aebb603ed475714447c797f8b37edd67a1bd1d89ded7ee8f429 | Triage

Analysis

max time kernel
93s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 20:16

Sharing

Report Analysis Logs

General

Target

e2408c40957dbeb3b7e4352d3e640bf1.dll
Size

333KB
MD5

e2408c40957dbeb3b7e4352d3e640bf1
SHA1

04eb5f1d633e68f72a431807cbf2fa900be2b910
SHA256

abf88f8275891aebb603ed475714447c797f8b37edd67a1bd1d89ded7ee8f429
SHA512

4567b120d9960e0a262560dc5592ecb4acd73124af91ddb84dbc05343b141545d91bc1d33662f38d937921505819910c484aac480350441c75ba6b3d51ff8fe6
SSDEEP

6144:QVkODmIel4Dne6D2s3hxgkYEix7jYRAIJ78rRUf:WkODnel4DneIvgk0x7sRjC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 3132	3816	rundll32.exe	85
PID 3816 wrote to memory of 3132	3816	rundll32.exe	85
PID 3816 wrote to memory of 3132	3816	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2408c40957dbeb3b7e4352d3e640bf1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2408c40957dbeb3b7e4352d3e640bf1.dll,#1
  2⤵
  PID:3132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads