537f8193a6a203eeebe5571f09aef2aa0876b5abdcd5f8eb40d6bd208c4b3647 | Triage

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 21:42

Sharing

Report Analysis Logs

General

Target

1f524fca2644a5909be743cdad1aa5e8.dll
Size

6KB
MD5

1f524fca2644a5909be743cdad1aa5e8
SHA1

ee39b75f2b1fadd02be7c3d52c568daa5ce52a89
SHA256

537f8193a6a203eeebe5571f09aef2aa0876b5abdcd5f8eb40d6bd208c4b3647
SHA512

3531ad1ba12c3ae4a787a7152aa1983334261e08ed4559d0ab1389987e6ef7f77ac92ef5fc393de6d1f07b3e5efd623d7458862781717edb0d9296a26746dbb7
SSDEEP

48:6DOdd5YVOiFVE/y/sqwokyJyi0eB+BDq9J5S9:piFVE/y6okJ6B+FqX5S9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 4936	928	rundll32.exe	87
PID 928 wrote to memory of 4936	928	rundll32.exe	87
PID 928 wrote to memory of 4936	928	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f524fca2644a5909be743cdad1aa5e8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f524fca2644a5909be743cdad1aa5e8.dll,#1
  2⤵
  PID:4936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads