b370e87135c3096eb90581c7d0e57e10d01882f8f6030baa201c2118c43f7ac0 | Triage

Analysis

max time kernel
85s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 01:33

Sharing

Report Analysis Logs

General

Target

b370e87135c3096eb90581c7d0e57e10d01882f8f6030baa201c2118c43f7ac0.dll
Size

4KB
MD5

b7a95ffc218e2ba7b0f4f09e4539ff9a
SHA1

dd15150e113c4967b5c8d6f5158c9ad950270e7b
SHA256

b370e87135c3096eb90581c7d0e57e10d01882f8f6030baa201c2118c43f7ac0
SHA512

df1da06d57daf95e2ad613d8d00263cb6c2764515ca6e948ee9a7815a4ba8fa624e933fe19cd40e7c77d7e51d3a40779b93174bb360ec0933f6313f3fb258650

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 1508	1556	rundll32.exe	84
PID 1556 wrote to memory of 1508	1556	rundll32.exe	84
PID 1556 wrote to memory of 1508	1556	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b370e87135c3096eb90581c7d0e57e10d01882f8f6030baa201c2118c43f7ac0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b370e87135c3096eb90581c7d0e57e10d01882f8f6030baa201c2118c43f7ac0.dll,#1
  2⤵
  PID:1508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads