c52a0f9a3a81fa9aa70c6178306f0889ccd01bb98286ba3893fc03f279d5bd72 | Triage

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 04:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

44640e1748c4dcb31eb3c41db11fb190.dll
Size

6KB
MD5

44640e1748c4dcb31eb3c41db11fb190
SHA1

2db019cf4ff8476566017cd9faa9456b74fa5d90
SHA256

c52a0f9a3a81fa9aa70c6178306f0889ccd01bb98286ba3893fc03f279d5bd72
SHA512

7c10497313bacbcacef4b72290a78bb9b524374bcff1a9d794cf266ac2d56da1d03f29bb99fb3176d9c7b65e11bef116d3b0f93ef7bdb539792a6920dfc6526a
SSDEEP

96:hy859x0P8MaXr5/wR8Yvvo3lDPYSZOKo5SuPS59ffJWj6:F5oL4/B8volPP0SuEl

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 3524	2504	rundll32.exe	82
PID 2504 wrote to memory of 3524	2504	rundll32.exe	82
PID 2504 wrote to memory of 3524	2504	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44640e1748c4dcb31eb3c41db11fb190.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44640e1748c4dcb31eb3c41db11fb190.dll,#1
  2⤵
  PID:3524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads