874d8ab5a095ffcb98786ae85160edc3dfb9eadadb98858e54d55578eea8473f | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 22:28

Sharing

Report Analysis Logs

General

Target

4947572113837e137504a67ae27068e6.dll
Size

7KB
MD5

4947572113837e137504a67ae27068e6
SHA1

b3f9d4c66c6521eadd62b5e8a23ee9ee68fee197
SHA256

874d8ab5a095ffcb98786ae85160edc3dfb9eadadb98858e54d55578eea8473f
SHA512

0df75c06169c2d02b68f8937a23916db35d3e60c59849872a66c440d4dffa1f3ccad5754824a6c06803bcb4e5b2a728d26649835a1e1a1892f97a6ef304dd833
SSDEEP

96:wb4VHccYJUC/aFbz/j0OvaPcd3cX5aXW:wUaJf/aFbP0OH2JaX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 4404	4784	rundll32.exe	85
PID 4784 wrote to memory of 4404	4784	rundll32.exe	85
PID 4784 wrote to memory of 4404	4784	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4947572113837e137504a67ae27068e6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4947572113837e137504a67ae27068e6.dll,#1
  2⤵
  PID:4404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads