3d0c4f6a251df4072539637590a1c7a11b50ec1dba98aa44757ea75e93b13ceb | Triage

Analysis

max time kernel
139s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 05:49

Sharing

Report Analysis Logs

General

Target

MSWB70804.dll
Size

514KB
MD5

d00471d0a4fd9e175633611152f0d2ed
SHA1

b3f574dde3a3b4812a324ca344dc3368a9dc5464
SHA256

3d0c4f6a251df4072539637590a1c7a11b50ec1dba98aa44757ea75e93b13ceb
SHA512

308312938ea91cd0868a25924ed68e2d581918cf5ba5d73f4d8794fc723b65bd1d1e83b1fe50c6b4f17acd753f72dae9139893a8c7b89e721341481d562d7885
SSDEEP

12288:OuBBdPDfjY39bpBFncoV53jVWUYryWKdBLt:O0943hnF3Tj0UYryWKdBL

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 3044	4524	rundll32.exe	83
PID 4524 wrote to memory of 3044	4524	rundll32.exe	83
PID 4524 wrote to memory of 3044	4524	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MSWB70804.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MSWB70804.dll,#1
  2⤵
  PID:3044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads