64f0803dc343b57b1f9114f1bfb9eeacf9d76b193620621561a280827b0b6326 | Triage

Analysis

max time kernel
93s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 19:05

Sharing

Report Analysis Logs

General

Target

402323332/Examples/MyDll.dll
Size

7KB
MD5

f411e074e80d44b924f1cb921a44acdd
SHA1

eb9eb8574672f71af53c6127ffd0fc9e0049b7de
SHA256

f707ae04c81219368a33238e9785bb41dab4b2ff694b42fa79b3764ba43faff0
SHA512

d4db869a9eadf43f2f57c1002bd2709ac393ea095b9dd0575e9040770b437beb8ceaf5df81fd853ff5cf1c13f9649c562c9839f12aa29437e5aad2097df10bc0
SSDEEP

96:nPEEzPZN8j85Ji1sAN0g4dD2sjYlQ+KLmH:n3DZN8WJi1DNHe7wfKLmH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 4196	396	rundll32.exe	83
PID 396 wrote to memory of 4196	396	rundll32.exe	83
PID 396 wrote to memory of 4196	396	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\402323332\Examples\MyDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\402323332\Examples\MyDll.dll,#1
  2⤵
  PID:4196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads