d8e3d6814dcb81a038149c7764c6e6ae76a63dec760203c57f682acb3d43fbbf | Triage

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 05:46

Sharing

Report Analysis Logs

General

Target

Role3D.dll
Size

295KB
MD5

a4dab227a05dcfb69e4892723c5a3286
SHA1

dae17f6e1313397a57bb6d2e5f8d89bc47ebf7e0
SHA256

d8e3d6814dcb81a038149c7764c6e6ae76a63dec760203c57f682acb3d43fbbf
SHA512

8800ab0102ebc098a4e933cd696be94f6d7a7d207313e13636fc2a8a0365b9523aa286c58f614c0e52ba188acd1158d8c85a9bb041f21ef4237153ab5f595ea8
SSDEEP

6144:zgLpBVtatbyKPP/Kg7qnlDQeeaQeefQeesQeeqQQeehQeemgiQf2Vcs6XOnAMZsN:zgLpBVwtbT/pqiQfm2l

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 1276	1248	rundll32.exe	82
PID 1248 wrote to memory of 1276	1248	rundll32.exe	82
PID 1248 wrote to memory of 1276	1248	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Role3D.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Role3D.dll,#1
  2⤵
  PID:1276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads