5e073aaab5aef67fc9b9c5dd851bf4bd6cb7ba08898086d6646e990d699f15dd | Triage

Analysis

max time kernel
99s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 22:07

Sharing

Report Analysis Logs

General

Target

5e073aaab5aef67fc9b9c5dd851bf4bd6cb7ba08898086d6646e990d699f15dd.dll
Size

3KB
MD5

9e4e0f75d44c94587193909a1395fe12
SHA1

68e227f7869eaf1613bdc015b7e18a4e8e7f8073
SHA256

5e073aaab5aef67fc9b9c5dd851bf4bd6cb7ba08898086d6646e990d699f15dd
SHA512

594bbae8d27ed8e12871209920539349451f35c35b26c3cb6f04ca25988428952f00e79a8a0914a11a21aeed8855e2fda94f1ea049ad4039bcfd5e95a3d77e3f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 3276	2572	rundll32.exe	89
PID 2572 wrote to memory of 3276	2572	rundll32.exe	89
PID 2572 wrote to memory of 3276	2572	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e073aaab5aef67fc9b9c5dd851bf4bd6cb7ba08898086d6646e990d699f15dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e073aaab5aef67fc9b9c5dd851bf4bd6cb7ba08898086d6646e990d699f15dd.dll,#1
  2⤵
  PID:3276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads