fb7654ccc344bc315476ac691076e2a178fbb03b69de3a8f97f73c47dddf9e0b | Triage

Analysis

max time kernel
134s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 22:34

Sharing

Report Analysis Logs

General

Target

50107b428b74a8902185ba4f59aa90e7.dll
Size

6KB
MD5

50107b428b74a8902185ba4f59aa90e7
SHA1

2959740e7e3b28c89db493110484c215ce6bd19f
SHA256

fb7654ccc344bc315476ac691076e2a178fbb03b69de3a8f97f73c47dddf9e0b
SHA512

cb3971f9b6138596d3719511e8bd7e0a9097c0133ea41466f311c288030f41842979ee44fff1ed717cb19c41bd73e63cef10a2f4351274599e4e033d74e41219
SSDEEP

48:6AA35YVOQDV8FszwydlAYsLFV3G0+B+BDq9J5S2:0QDV8FscMjsLFV3GB+FqX5S2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 4260	4036	rundll32.exe	85
PID 4036 wrote to memory of 4260	4036	rundll32.exe	85
PID 4036 wrote to memory of 4260	4036	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\50107b428b74a8902185ba4f59aa90e7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\50107b428b74a8902185ba4f59aa90e7.dll,#1
  2⤵
  PID:4260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads