6f26fca83c45a7320ebbe45cd4ddca7d11bafd5e70e150d97b84c94db06ef064 | Triage

Analysis

max time kernel
93s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 22:41

Sharing

Report Analysis Logs

General

Target

5d2216e22baec8aa7531f32a9cfbeccc.dll
Size

6KB
MD5

5d2216e22baec8aa7531f32a9cfbeccc
SHA1

09980870f2aea8aecf7cdff4b75a22c015dd5c20
SHA256

6f26fca83c45a7320ebbe45cd4ddca7d11bafd5e70e150d97b84c94db06ef064
SHA512

e6f15ddc39808d056012e018a63a3a42b485db23527708d3b8472ffc6e04c22a00d94513dfde3160ccfa53276179edd52ce9dff27e6a64fd7e21be4476f769f1
SSDEEP

48:6AA35YVOQDV8FszwydlAYsLFV3G0Y2B+BDq9J5S2:0QDV8FscMjsLFV3vB+FqX5S2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 5016	1260	rundll32.exe	84
PID 1260 wrote to memory of 5016	1260	rundll32.exe	84
PID 1260 wrote to memory of 5016	1260	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d2216e22baec8aa7531f32a9cfbeccc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d2216e22baec8aa7531f32a9cfbeccc.dll,#1
  2⤵
  PID:5016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads