9cc2a6c640288355ca462ec468b1b8a31962d7dd186d1dbd5c5039d54f177fb9 | Triage

Analysis

max time kernel
151s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 05:52

Sharing

Report Analysis Logs

General

Target

2d30b3fb87ca3cf64e315e676628890e.dll
Size

6KB
MD5

2d30b3fb87ca3cf64e315e676628890e
SHA1

04226673d4822d4c185e889e431c141970fe2f1d
SHA256

9cc2a6c640288355ca462ec468b1b8a31962d7dd186d1dbd5c5039d54f177fb9
SHA512

1fcf0976768a47a5d4dd4a0cca0aea00cfbdd3fe0a9d956e12a90a737bfd506ce7be210a50e63aef899ac8e05fc522ca49b8f9f46007aed84d495be83e831a95
SSDEEP

48:6WQV5YVOqtV0H1pw9ygYVUG0MOB+BDq9J5SC:8qtV0HAr4CB+FqX5SC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 324 wrote to memory of 1512	324	rundll32.exe	85
PID 324 wrote to memory of 1512	324	rundll32.exe	85
PID 324 wrote to memory of 1512	324	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d30b3fb87ca3cf64e315e676628890e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d30b3fb87ca3cf64e315e676628890e.dll,#1
  2⤵
  PID:1512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads