3a35b752d52ae063e4d86fd340d01bdd94d4d8276bff2e2817d296424834dcf7 | Triage

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 11:41

Sharing

Report Analysis Logs

General

Target

MSWB70404.dll
Size

516KB
MD5

e7437d2180aa1e642b1e3b78f5a0f37e
SHA1

f4f92d0e27145671fa5867b28975a41afe36220a
SHA256

3a35b752d52ae063e4d86fd340d01bdd94d4d8276bff2e2817d296424834dcf7
SHA512

a8b77ae9f10aff0214d4e42fb99ef902cf93f9f248af090270e98ef43e28752efdcfeb8fa7df0e0361e4922a28ad26a611cc0cdccff49d648c1f1bda2f523246
SSDEEP

12288:Nrf9nDLL1ci2yKdZpyXhfT+BrIYGgYEG/dWLP:NbVL1/25d+XUBrjGgYEG/dWLP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 3936	1556	rundll32.exe	83
PID 1556 wrote to memory of 3936	1556	rundll32.exe	83
PID 1556 wrote to memory of 3936	1556	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MSWB70404.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MSWB70404.dll,#1
  2⤵
  PID:3936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads