755d11ba3943ba14071f4bdb5b10d3a1db96fdbf637a2851317304aa2523a4b4 | Triage

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 09:12

Sharing

Report Analysis Logs

General

Target

DiracLE.dll
Size

268KB
MD5

ce45f9ad921fb1c0cde86485a8fe2b8c
SHA1

784eb77eaa69ffa5741ab92bde82b1e2524d4335
SHA256

705bbf872105d56c548f39923b7a1b7309dde71cd329ac611543650a4fdbd73a
SHA512

25f8e5932b3fdfd7b59bfa73b973738f4da6feb08d1e77714fc613a113ad536795435217591c343f227541a07eb1e2f5bc0eb346a1c9d6f87d19ce4a8316637f
SSDEEP

3072:kCkwXBHGg5FT+eXNdobNz+NFdor2gUbbzslv9oQ7:kUXNdQQ/dor2gUbbzslJ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 5000	2468	rundll32.exe	79
PID 2468 wrote to memory of 5000	2468	rundll32.exe	79
PID 2468 wrote to memory of 5000	2468	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DiracLE.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DiracLE.dll,#1
  2⤵
  PID:5000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads