f63d102caa1e226b830feae2b2e08e0cbf539f29cb5c789fb9f5be662a2af3b5 | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 05:48

Sharing

Report Analysis Logs

General

Target

2532e14b5a6a6edb8fe46d3213ccc907.dll
Size

6KB
MD5

2532e14b5a6a6edb8fe46d3213ccc907
SHA1

8c3e7f8085cd57d7f04f23847c74b9b5a9f30f6f
SHA256

f63d102caa1e226b830feae2b2e08e0cbf539f29cb5c789fb9f5be662a2af3b5
SHA512

8ffa60b3d264955912eacc7c505d6f57fe31c74d2e442a3c3d8a8d280753d7a72925710b9420c3782678ac4044aad0bba26da75026500796ab4f9e74ada3350f
SSDEEP

48:63mll5YVOa9VUX1iwbQWu00B+BDq9J5SH:VDa9VUX9bQWUB+FqX5SH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 1708	4936	rundll32.exe	85
PID 4936 wrote to memory of 1708	4936	rundll32.exe	85
PID 4936 wrote to memory of 1708	4936	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2532e14b5a6a6edb8fe46d3213ccc907.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2532e14b5a6a6edb8fe46d3213ccc907.dll,#1
  2⤵
  PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads