a40e7d49005e391ac903e58c47faaaebc3f60ee85742e549dfbad9536f687e58 | Triage

Analysis

max time kernel
92s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 22:45

Sharing

Report Analysis Logs

General

Target

671cd07564b801ebf23037e68639df13.dll
Size

6KB
MD5

671cd07564b801ebf23037e68639df13
SHA1

f5826c643b0201a36deb1e619b01e80aee8db110
SHA256

a40e7d49005e391ac903e58c47faaaebc3f60ee85742e549dfbad9536f687e58
SHA512

bbed7eef95dc754dc0783567935e63adf92a7fc536d02377bf6cf47f0859a6acab40b645d7e57140ea67c38031d6a006c0ec7de4f02736d0c6f4619ae0d80d3d
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0vB+BDq9J5SH:VDa9VUX9bQWPB+FqX5SH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 3176	2504	rundll32.exe	86
PID 2504 wrote to memory of 3176	2504	rundll32.exe	86
PID 2504 wrote to memory of 3176	2504	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\671cd07564b801ebf23037e68639df13.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\671cd07564b801ebf23037e68639df13.dll,#1
  2⤵
  PID:3176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads