df86847188756fad36c3e6c8dad5f089b2092d659e6757bdd69e12988d3cba8c | Triage

Analysis

max time kernel
135s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 11:59

Sharing

Report Analysis Logs

General

Target

ARTH_DLL.dll
Size

92KB
MD5

0f8d1d620825b2eee252739c856542f8
SHA1

cb0a8ea9479ba69673037db3e0050a261ab49e78
SHA256

df86847188756fad36c3e6c8dad5f089b2092d659e6757bdd69e12988d3cba8c
SHA512

a5e1f8ec82816b2b0ab0cac83d497dae192b247b5013460fd6e62fbb727a04f293be6e967b8e85cd07b3f005e01f6ccee35c675cb65675dc5683adfd2ea58edf
SSDEEP

1536:fRAkYc54CDnQT2WY6ITqIikr7oAHytVAoXgu:fRAc5dLrxj7nytVAoX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 5064	4076	rundll32.exe	82
PID 4076 wrote to memory of 5064	4076	rundll32.exe	82
PID 4076 wrote to memory of 5064	4076	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ARTH_DLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ARTH_DLL.dll,#1
  2⤵
  PID:5064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads