d3efb7084142e12b3fe6cdb51c46c1ae643451cc73b4fff3680b307006ff0460 | Triage

Analysis

max time kernel
134s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03-05-2024 22:01

Sharing

Report Analysis Logs

General

Target

XInput9_1_0.dll
Size

11KB
MD5

e7f1cc85f97c92b5eca447ed7ca7dabb
SHA1

6512719f6a0875675034e39f0cd29f435c42b008
SHA256

9e25ae49f8a2061d2c31f9c1c381010e04f7c3800f33daf47168763a2b9ccfb1
SHA512

bdd0814327a8cc14a11210745b3e9ed4def7629b32a8fa4a7ac139e1ba0238e49e057d49f4d49ac2b599dab172edbd2b1adc9ba274cc9057652abc2b5243ac46
SSDEEP

192:EQdcdW6Ss9HI23vSdZXShyWJT/BEaE+EgwijOyfaCwmPgbDLTGc:K/SspI2WgHJZlj/fa/tvi

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3300 wrote to memory of 3992	3300	rundll32.exe	rundll32.exe
PID 3300 wrote to memory of 3992	3300	rundll32.exe	rundll32.exe
PID 3300 wrote to memory of 3992	3300	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XInput9_1_0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3300

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XInput9_1_0.dll,#1
2⤵
PID:3992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads