940997c1e6a7d171298e2b540aa4a42249b2ad8fe82419ada394c8d9931c3514 | Triage

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bbffae262e23be0d4914b8caf10172e3.dll
Size

7KB
MD5

bbffae262e23be0d4914b8caf10172e3
SHA1

b2dcdde3c076a04f08becb2b6daa65cc9b9dc34e
SHA256

940997c1e6a7d171298e2b540aa4a42249b2ad8fe82419ada394c8d9931c3514
SHA512

e416be991f4420ee0fe1f2b7ff6c747b340b8879932279106b45e34297c7b53d870856f815f74355f0747451b019fe2180b7c5907c35d19929a9e39363501d6c
SSDEEP

96:wb4VHccYJUC/aFbz/j0OvaPxd3cX5aXW:wUaJf/aFbP0OG2JaX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1940	1628	rundll32.exe	85
PID 1628 wrote to memory of 1940	1628	rundll32.exe	85
PID 1628 wrote to memory of 1940	1628	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bbffae262e23be0d4914b8caf10172e3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bbffae262e23be0d4914b8caf10172e3.dll,#1
  2⤵
  PID:1940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads