e35f9a1a1f351e8f21324ed8c126be12c615def267d72027160615f258cfc217 | Triage

Analysis

max time kernel
91s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 03:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e35f9a1a1f351e8f21324ed8c126be12c615def267d72027160615f258cfc217.dll
Size

3KB
MD5

9f54c2848e3ba08a3ecfefaaa1471b96
SHA1

be69c7fe56900b0fbdbc58e7d70936ce38e1d4ae
SHA256

e35f9a1a1f351e8f21324ed8c126be12c615def267d72027160615f258cfc217
SHA512

646aac2e3ff0c345e5c8dbbba5af5e5d3d5528cca49e7bc86ca650773cb44c890111d2a7fe0d265460829dde86ec55933ce0d8288dbb312776a733daaa42b2f3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 4268	2748	rundll32.exe	87
PID 2748 wrote to memory of 4268	2748	rundll32.exe	87
PID 2748 wrote to memory of 4268	2748	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e35f9a1a1f351e8f21324ed8c126be12c615def267d72027160615f258cfc217.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e35f9a1a1f351e8f21324ed8c126be12c615def267d72027160615f258cfc217.dll,#1
  2⤵
  PID:4268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads