34e2f8651fb05efe29066fba3b87c60826502427dd5c4a3251d64d8e36699f58 | Triage

Analysis

max time kernel
133s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 12:01

Sharing

Report Analysis Logs

General

Target

dbnetlib.dll
Size

84KB
MD5

1eeb22f6fcd0aeb0d78bc4839e889d3a
SHA1

3aa719ee1d4b03bca57f888e84ca9324da71175c
SHA256

34e2f8651fb05efe29066fba3b87c60826502427dd5c4a3251d64d8e36699f58
SHA512

95561391d8ab7065818ed6bad7e96404a21459f8c5d0f8a2466a70b5cb7ce43658b441db90a82f1a42c5a00091e742422fb575446e84e8cce226475f247868d3
SSDEEP

1536:pxhts+tv8FSEb9dzXORoQhM972XXbN0pmFeIi:pTodbc+2KpMeV

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1780	900	rundll32.exe	82
PID 900 wrote to memory of 1780	900	rundll32.exe	82
PID 900 wrote to memory of 1780	900	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbnetlib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbnetlib.dll,#1
  2⤵
  PID:1780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads