e383f59c0f9c2cc20afcf20d6ef4c1690d30d724957aa3310b88acfcb5fd7dc2 | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 08:58

Sharing

Report Analysis Logs

General

Target

12.dll
Size

10.0MB
MD5

2c3825d009c171acb36b9f25f7386a8d
SHA1

d48eb66c37de71aded56ffa8a5b5b1e9577a9c52
SHA256

b5fe4969c95b54c76871332469b2077b668a180692d6a31afa00536c19e3b344
SHA512

f3960c1559b5be2926da58ee7f01ca08ac4ed97db68ef0ad424462c0aca6e58747ac5373e706fae5b46f0ec1aa6d5cc5217a51d0ff64ee167a04d7e60e644b05
SSDEEP

196608:JvZhvJ/2+X889nu1egUURkM7/EspU6ZgHa5gaaeA3QiKkzHpBJm6o4e:VV++Xix7EsysSa5KBQiKkzHvPo4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4456 wrote to memory of 4464	4456	rundll32.exe	rundll32.exe
PID 4456 wrote to memory of 4464	4456	rundll32.exe	rundll32.exe
PID 4456 wrote to memory of 4464	4456	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4456

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12.dll,#1
2⤵
PID:4464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads