8454e4a8b248a7f384035e9b45d9badb5f121e9d047d9dcce22bb4ee7e73e85b | Triage

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 11:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/inst.dll
Size

24KB
MD5

b5854e134a6c5c56f79b02339cb6ba50
SHA1

2b9e6f11c107cf0bca38211f60b72469a32d73ce
SHA256

5e81fec3985cd257e1855c7f6205e718a9ba25142ddd5da33dc10f7d02018287
SHA512

de72d64c5ce9e874ab8cf8fb88098b55350f5762abd1e3fecf33c72140c5631aff457acce9b1310410557c2603d20d05aff4e640191ef2cd4c72506634882a04
SSDEEP

96:ZIneYYDrT2T/bA0391Xh0Os9KmEIPxm6IB7mV8oafTvxUru/:fYYXT2TTB9pqOzuoP1mV4z+ru

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 636	3932	rundll32.exe	83
PID 3932 wrote to memory of 636	3932	rundll32.exe	83
PID 3932 wrote to memory of 636	3932	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\inst.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\inst.dll,#1
  2⤵
  PID:636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads