138fded68797bb2b65237f4d14280b914ee3ee1eb55938e861b3da4bbfad4b10 | Triage

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:26

Sharing

Report Analysis Logs

General

Target

dpIdent.dll
Size

406KB
MD5

cac1989edb7ef8b80e7a232649aea084
SHA1

6184c63124bbfed0da320e12fa923ec378ad6771
SHA256

138fded68797bb2b65237f4d14280b914ee3ee1eb55938e861b3da4bbfad4b10
SHA512

bbcee1d61d16fbea9075e50aa05d3a90516353f661182a6ca80c68f3da1f50fb41fa8f2480c3c03217fbbe21f9139a0e4eb7eaa7db3964740937a0032ec5c368
SSDEEP

6144:FWnrESutPvXtx9rEqyMjH8QsawqhdwvpOigu4/AAORcfQi:FjtXtxdEqDH+BhO7u4/Axi

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 60	1628	rundll32.exe	83
PID 1628 wrote to memory of 60	1628	rundll32.exe	83
PID 1628 wrote to memory of 60	1628	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dpIdent.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dpIdent.dll,#1
  2⤵
  PID:60

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads