127866f2c16eda683153d2a9088cd545f0cd541e4955effb220e79baa4461184 | Triage

Analysis

max time kernel
146s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 08:21

Sharing

Report Analysis Logs

General

Target

adc.dll
Size

28KB
MD5

90fb210a39450f5cc40685f1af8e8cba
SHA1

8a4d4b84c5a8de91c4123dcb1f097daea2e8344f
SHA256

3c20fa6446d636d46c9e049887437e794787574969e0b7818571da7169543f11
SHA512

522769d16dcc161e63b796c82ce6b78e3015f9836987c9a22222858b422160acda6516fc320e28dd103df8bafce5eac2c1209d9af0bec9a8adfbb889086a60d0
SSDEEP

384:gRKcuNzFctEVKxoQKxqgiDi1tlXaZdRe8BwWkez01OTOtXQfWYJLuPkCQu:SKLSohxqgt1tdMdQYzeOTOtgfPLuD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 1460	4604	rundll32.exe	87
PID 4604 wrote to memory of 1460	4604	rundll32.exe	87
PID 4604 wrote to memory of 1460	4604	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\adc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\adc.dll,#1
  2⤵
  PID:1460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads