58467e7d680f48e945add02dba6f8b0d099edd5fc85b4f19e3d0c29ec9831794 | Triage

Analysis

max time kernel
145s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 21:02

Sharing

Report Analysis Logs

General

Target

58467e7d680f48e945add02dba6f8b0d099edd5fc85b4f19e3d0c29ec9831794.dll
Size

3KB
MD5

a5028da19c5c9ed1c314bb0c9305b109
SHA1

8933cf4b06fee0029815a73a98d58f9558928c62
SHA256

58467e7d680f48e945add02dba6f8b0d099edd5fc85b4f19e3d0c29ec9831794
SHA512

6a14f874a83ca6e912dadcad95fdb8517eda44dfde2520a8decaeb2da258e847aa535ab4122e4b8b982605396a5855b3db5ae0ded6f030d8de20b47e48412455

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 2764	1460	rundll32.exe	84
PID 1460 wrote to memory of 2764	1460	rundll32.exe	84
PID 1460 wrote to memory of 2764	1460	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\58467e7d680f48e945add02dba6f8b0d099edd5fc85b4f19e3d0c29ec9831794.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\58467e7d680f48e945add02dba6f8b0d099edd5fc85b4f19e3d0c29ec9831794.dll,#1
  2⤵
  PID:2764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads