31b96f14af44880ea440a53f41edef339ae0e3c916b51a8b4426f7bd89ebad7f | Triage

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 21:18

Sharing

Report Analysis Logs

General

Target

212e928a3a69a8842b0086c3f5e3daa0N.dll
Size

6KB
MD5

212e928a3a69a8842b0086c3f5e3daa0
SHA1

71c10217813c28df5a3af711db4e371d8d2af897
SHA256

31b96f14af44880ea440a53f41edef339ae0e3c916b51a8b4426f7bd89ebad7f
SHA512

943063c0ede66837b4ce00050d506519a1d623a14aa07f1669893a4e070cbc69d72c8e022c6d9b00a70de1ba41a7e26e9b18dd25d5f72b594cb8d4ffcd986531
SSDEEP

48:6WQV5YVOqtV0H1pw9ygYVUG0cB+BDq9J5SC:8qtV0HAr45B+FqX5SC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 728	4564	rundll32.exe	83
PID 4564 wrote to memory of 728	4564	rundll32.exe	83
PID 4564 wrote to memory of 728	4564	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\212e928a3a69a8842b0086c3f5e3daa0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\212e928a3a69a8842b0086c3f5e3daa0N.dll,#1
  2⤵
  PID:728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads