815c5c516d54597fab23cb20fa2fe3afacdd699d89a8db6fc0027577f314007b | Triage

Analysis

max time kernel
91s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 23:39

Sharing

Report Analysis Logs

General

Target

ffb474ca0cafc5e8855d91763b4d923c.dll
Size

7KB
MD5

ffb474ca0cafc5e8855d91763b4d923c
SHA1

abec3ae1a1479045c2c6655ddbf7cac204b45041
SHA256

815c5c516d54597fab23cb20fa2fe3afacdd699d89a8db6fc0027577f314007b
SHA512

d9545822fff399eea67fd9b406c9ef7c49fb95af1415686edb02967f4e6858e9f5ce0def92443ccfb1dc1e6caa9df2249239bfae004bc3c7e8bfb431360861ea
SSDEEP

96:wb4VHccYJUC/aFbz/j0OvaPVd3cX5aXW:wUaJf/aFbP0Oi2JaX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 4852	116	rundll32.exe	85
PID 116 wrote to memory of 4852	116	rundll32.exe	85
PID 116 wrote to memory of 4852	116	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffb474ca0cafc5e8855d91763b4d923c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffb474ca0cafc5e8855d91763b4d923c.dll,#1
  2⤵
  PID:4852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads