fac0116bc8e321fffb55b78fed28ec20d20beac41305e3246708e10465e7f781 | Triage

Analysis

max time kernel
93s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 05:56

Sharing

Report Analysis Logs

General

Target

33c1b12c180877b27aad87ce67996e39.dll
Size

6KB
MD5

33c1b12c180877b27aad87ce67996e39
SHA1

088100ddf3897c057ba5254034b7731618ba9bf8
SHA256

fac0116bc8e321fffb55b78fed28ec20d20beac41305e3246708e10465e7f781
SHA512

f439ccda4979c52e786485dbed7e349c9841dc8b636942638d90b1f12771fe80f5f0560c4af7e182ba98e4cca8b972cda13dde587f52031a0dca6a2d54e92f04
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0gLCB+BDq9J5SH:VDa9VUX9bQWAWB+FqX5SH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 4056	4128	rundll32.exe	85
PID 4128 wrote to memory of 4056	4128	rundll32.exe	85
PID 4128 wrote to memory of 4056	4128	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33c1b12c180877b27aad87ce67996e39.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\33c1b12c180877b27aad87ce67996e39.dll,#1
  2⤵
  PID:4056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads