0b320a4ae8ad0e215c3556b09450620ed5dd41d330f748def2da037e884626d2 | Triage

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-04-2024 18:25

Sharing

Report Analysis Logs

General

Target

0b320a4ae8ad0e215c3556b09450620ed5dd41d330f748def2da037e884626d2.dll
Size

3KB
MD5

4c3bc8eefe56deb28782ef9958140aa5
SHA1

f6fde6997ca0dd0493e0f1d8780056652e89e1b7
SHA256

0b320a4ae8ad0e215c3556b09450620ed5dd41d330f748def2da037e884626d2
SHA512

d3b681324c3cb5dc4d09efcf446b416f47f9ed764e5d050a42f87225820317bd1a434c371ae9435272d442e83325d70dbc0822e6a8ffbc33cb5d606210b877bc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 1748	3540	rundll32.exe	85
PID 3540 wrote to memory of 1748	3540	rundll32.exe	85
PID 3540 wrote to memory of 1748	3540	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b320a4ae8ad0e215c3556b09450620ed5dd41d330f748def2da037e884626d2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b320a4ae8ad0e215c3556b09450620ed5dd41d330f748def2da037e884626d2.dll,#1
  2⤵
  PID:1748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads