a0424e11eeb0a5e1d994f28bb0c2e001a414263e4a67e4ab782efc686eda6d6d | Triage

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 05:59

Sharing

Report Analysis Logs

General

Target

38d0879f6433b77bcc5a1376d8ac3a5f.dll
Size

6KB
MD5

38d0879f6433b77bcc5a1376d8ac3a5f
SHA1

369c666753064b4d06cb87bef27d2f3fffa2e64f
SHA256

a0424e11eeb0a5e1d994f28bb0c2e001a414263e4a67e4ab782efc686eda6d6d
SHA512

e40ce48c2218db1b8b469a9f5de6b1e241c11ee8bda189d74d39813c83dc7bf33a848cda8269239ce67f191f0ffb9baed60778c3fb0ffa7c7ea09d8995269542
SSDEEP

48:6DOdd5YVOiFVE/y/sqwokyJyi0hB+BDq9J5S9:piFVE/y6okJlB+FqX5S9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 4928	464	rundll32.exe	84
PID 464 wrote to memory of 4928	464	rundll32.exe	84
PID 464 wrote to memory of 4928	464	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38d0879f6433b77bcc5a1376d8ac3a5f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38d0879f6433b77bcc5a1376d8ac3a5f.dll,#1
  2⤵
  PID:4928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads