f8ff876957a38b0c2fb01a77dd6b70830aa666252659f85fc256efcdba55a8a4 | Triage

Analysis

max time kernel
119s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 04:31

Sharing

Report Analysis Logs

General

Target

f8ff876957a38b0c2fb01a77dd6b70830aa666252659f85fc256efcdba55a8a4.dll
Size

3KB
MD5

7308a60d03b655619c94ae5c4d8e6454
SHA1

adf64ec985944e1377fc243950836d5c00d0c5f4
SHA256

f8ff876957a38b0c2fb01a77dd6b70830aa666252659f85fc256efcdba55a8a4
SHA512

673deea2271383a8928be14047c42e552ad4453e542f3d31121e3d8ddd422bb4f326be2b44f52e5fe97f1546b60959d822c87568912c56bcc0f1ac85f1fbbe1a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 2940	832	rundll32.exe	90
PID 832 wrote to memory of 2940	832	rundll32.exe	90
PID 832 wrote to memory of 2940	832	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8ff876957a38b0c2fb01a77dd6b70830aa666252659f85fc256efcdba55a8a4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8ff876957a38b0c2fb01a77dd6b70830aa666252659f85fc256efcdba55a8a4.dll,#1
  2⤵
  PID:2940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads