4a0dab7c7d59cadc090244263b1b6d377a3ae7c792022dad6c27490b3d6c1640 | Triage

Analysis

max time kernel
92s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 21:55

Sharing

Report Analysis Logs

General

Target

lzCDP.dll
Size

36KB
MD5

3bc434aec987c3e997ae1fec4aaa3a33
SHA1

8f66eb16969f56f2b666095ced9a5f4a15e725e7
SHA256

1f8adb3a205c014de92319cd26e7d2eae7fdba2ff542635b5ab0ebbf8343a478
SHA512

8043be5a22589937325302ec817f97ce7c3f0882e365d2770e920e3065b483482588299b633bb2eda4c285b0f457e47cfe4ad8927a343efcefd4ad9f30c381cc
SSDEEP

384:0St3dcWRvTpW5jdbGcmlO7FuPz+h7y+CoMbV86EoZo9pbE:0mdlvTpW5Jbv0P8rMbV86dZo95

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 3016	3480	rundll32.exe	83
PID 3480 wrote to memory of 3016	3480	rundll32.exe	83
PID 3480 wrote to memory of 3016	3480	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lzCDP.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lzCDP.dll,#1
  2⤵
  PID:3016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads