7ea112cf98ae96c2e5def06079680f04cc177c78a1eeb8136f759fd1bafc5a90 | Triage

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 11:12

Sharing

Report Analysis Logs

General

Target

$_5_/freebl3.dll
Size

296KB
MD5

a3c1cba32232b8c28d3551fb78307058
SHA1

0c07aee705c8e10d4b4cb9af43f0f6722e7f4c3a
SHA256

ee912f5dcb516747d4ab5497e4a61cfbc413efab61fafbca6646a320cf07f601
SHA512

c7f7bb85db1d1a15deb9dc862f7eefa19203bdf22b582ea0f31973dbba9abbeab7fb7babd32c2037f7c9411c747c7fb91762ef18cf1642ef1edd3072f1875765
SSDEEP

6144:y6uQXzEKoFU1cMeRX+wsE0qMbPpErdJIkE2qwQqqDL67PXGHrIrm:TuQXzEVVsE0qgxE5JIkPVVqn6jIp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1320	1736	rundll32.exe	81
PID 1736 wrote to memory of 1320	1736	rundll32.exe	81
PID 1736 wrote to memory of 1320	1736	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_5_\freebl3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_5_\freebl3.dll,#1
  2⤵
  PID:1320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads