c731d258550e4d4d39fea06850f46e7e3b9627bf1b5b2f08d1cd60282df74fa7 | Triage

Analysis

max time kernel
133s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 20:37

Sharing

Report Analysis Logs

General

Target

samp.dll
Size

1.6MB
MD5

43956738460be6d46b6807f730efc758
SHA1

8a8e610594888804f362bec88c10aa4f3bf99ebb
SHA256

969e33fffdd22704d176e5ecaac58ebe2e19e221a0b7a3c983b011d72fd8d9b5
SHA512

2a5f27892455e2c01e7a931559e379c134120066c76254ee80a33beda6ce62650e7a187a57131a78ef92aabc2b4ad0960746a450c41b88e9487be7b5d238be1a
SSDEEP

49152:1n2rRdXF6w3W632CvecSHT18oUDpFOjwyKcdQA:WRRF6mWc2CvecSHTvHZ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 3168	4956	rundll32.exe	82
PID 4956 wrote to memory of 3168	4956	rundll32.exe	82
PID 4956 wrote to memory of 3168	4956	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\samp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\samp.dll,#1
  2⤵
  PID:3168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3168-0-0x0000000010000000-0x00000000102AE000-memory.dmp

Filesize
2.7MB

Download