6cb38e94512441c63b111512c2ce3db7eaa8fd6bc0babe57cd3cbbf6098f3bc7 | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 22:29

Sharing

Report Analysis Logs

General

Target

6cb38e94512441c63b111512c2ce3db7eaa8fd6bc0babe57cd3cbbf6098f3bc7.dll
Size

4KB
MD5

93ca3eb04b57ae04f0c3fb8b3c564957
SHA1

f55d09ed96d7b43af0237dc8e84a369f87329a61
SHA256

6cb38e94512441c63b111512c2ce3db7eaa8fd6bc0babe57cd3cbbf6098f3bc7
SHA512

1a2dea75fc8909150e5a6e1c77477e05087c3f4a0af5437c83edd9e91105bac72efcb67dcc0bb01f6e0066f6ed3414009e29180d1efe2805b7ceed89180015da

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 900	3752	rundll32.exe	85
PID 3752 wrote to memory of 900	3752	rundll32.exe	85
PID 3752 wrote to memory of 900	3752	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6cb38e94512441c63b111512c2ce3db7eaa8fd6bc0babe57cd3cbbf6098f3bc7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6cb38e94512441c63b111512c2ce3db7eaa8fd6bc0babe57cd3cbbf6098f3bc7.dll,#1
  2⤵
  PID:900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads