d88e7a747d4889013c3b2eea2a99d28f4a559d8801296906476d8475a1967fda | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 20:44

Sharing

Report Analysis Logs

General

Target

_hashlib.dll
Size

316KB
MD5

2caaf6cc71463871539c0d37c6bb4a0f
SHA1

1a3b9b9db79e5e34c7733d773c19a1975b52fe86
SHA256

dc0e9c390a990fc26407188226b94d8ef729fd56cc358cefdc221d6fce0dab7a
SHA512

8053f5eeeefc1fc0e3cfccb02f79966ebf0d0f6b24bcc5e29e546b9902eaa97b5cdf7372bb7b73b2e52d88530965c065b631bf43b3474642b03b1a91a3107b03
SSDEEP

6144:MSFQbtZ1GNaw1ZZeVroyFRP/C2HFCRlkCplz:9QALaRS2XC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2412	2096	rundll32.exe	82
PID 2096 wrote to memory of 2412	2096	rundll32.exe	82
PID 2096 wrote to memory of 2412	2096	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_hashlib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\_hashlib.dll,#1
  2⤵
  PID:2412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads