a9d027beca6cd28afff71a08224ba47f0b0c9654e643d11d91c5ebc90d206724 | Triage

Analysis

max time kernel
133s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 13:09

Sharing

Report Analysis Logs

General

Target

System.Net.WebSockets.Client.dll
Size

62KB
MD5

51bdda264b5ef6f7264574fcc697c66b
SHA1

7d0d413efefb6745c6be6fddecf072b62f8d9a3a
SHA256

a9d027beca6cd28afff71a08224ba47f0b0c9654e643d11d91c5ebc90d206724
SHA512

464e25b34d10d6f1d7f90d9dc391ceb5f9f6283320dc2c523195cb56ed6c7807257897fa73c8fd138182e4452d8d75aa19e5001a5f700c6ef1ef7db5b2ea2379
SSDEEP

1536:iYecI2Abfo4UcEjIZAq39aceZxXzAOQh2D:iYecIzbA4Uc9BeMOf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 1308	4848	rundll32.exe	83
PID 4848 wrote to memory of 1308	4848	rundll32.exe	83
PID 4848 wrote to memory of 1308	4848	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.Net.WebSockets.Client.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.Net.WebSockets.Client.dll,#1
  2⤵
  PID:1308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads