a9baf4d43aab6cdb2c6e0d9af99eb4adbcac97b8977fe231da2d67c93a8e4a10 | Triage

Analysis

max time kernel
91s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 23:37

Sharing

Report Analysis Logs

General

Target

f255b1c4d342ecc06596e20d0a7818e8.dll
Size

6KB
MD5

f255b1c4d342ecc06596e20d0a7818e8
SHA1

371169de6f061e8fe756ec418c8475407cde3082
SHA256

a9baf4d43aab6cdb2c6e0d9af99eb4adbcac97b8977fe231da2d67c93a8e4a10
SHA512

ed9a2d56433849d8787497bf683cb90801e22481902c2f8a54e30367d27d4567fa0414b57ff4aa3b61b28a1a11242f71006dec24d83917e75d9f7075f3d136c2
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0LxB+BDq9J5SH:VDa9VUX9bQWrxB+FqX5SH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 1620	4404	rundll32.exe	85
PID 4404 wrote to memory of 1620	4404	rundll32.exe	85
PID 4404 wrote to memory of 1620	4404	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f255b1c4d342ecc06596e20d0a7818e8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f255b1c4d342ecc06596e20d0a7818e8.dll,#1
  2⤵
  PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads