3c6293be8f1ff48fb6e458f62d41f5d28d1def5dbaef731bbf7584f8a033054e | Triage

Analysis

max time kernel
51s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 20:57

Sharing

Report Analysis Logs

General

Target

3c6293be8f1ff48fb6e458f62d41f5d28d1def5dbaef731bbf7584f8a033054e.dll
Size

3KB
MD5

ba5b3b4227b2dd6281b2d3692dc028c2
SHA1

0df1edc5e88dc62d1450b51e40fe174b1609d574
SHA256

3c6293be8f1ff48fb6e458f62d41f5d28d1def5dbaef731bbf7584f8a033054e
SHA512

1670c43462a9979d93f6260f3032c4cd429b3903b8a55283a185cf4008b7ab1395f39e2c2fb53ad5db99c122667580f1fc2bc36af6cf9efe392791bb1988846e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 432	1548	rundll32.exe	80
PID 1548 wrote to memory of 432	1548	rundll32.exe	80
PID 1548 wrote to memory of 432	1548	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c6293be8f1ff48fb6e458f62d41f5d28d1def5dbaef731bbf7584f8a033054e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c6293be8f1ff48fb6e458f62d41f5d28d1def5dbaef731bbf7584f8a033054e.dll,#1
  2⤵
  PID:432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads