1761a67791114c2a3887b063f91e7f9ed27166dc759215ae7e190bcb3d84a34c | Triage

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 09:13

Sharing

Report Analysis Logs

General

Target

b8c16b7f2dbf2cbaf0931e21da493370N.dll
Size

2.2MB
MD5

b8c16b7f2dbf2cbaf0931e21da493370
SHA1

5ee91edf1618a854cf1f47d4fd39b88a993c52e2
SHA256

1761a67791114c2a3887b063f91e7f9ed27166dc759215ae7e190bcb3d84a34c
SHA512

cae9d5645e3272deda1d75a6752fa5280ea927fb01c2b99bce02d67c6f5d269aa93d2eca878240ce6641d64d902432ccd5c9071346dad9aa2799c20635c551bf
SSDEEP

49152:XUPrrq1ErZYCHD8/54w8mrkXQaDjIsiI:EPxnlX7jiI

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 3260	2456	rundll32.exe	83
PID 2456 wrote to memory of 3260	2456	rundll32.exe	83
PID 2456 wrote to memory of 3260	2456	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8c16b7f2dbf2cbaf0931e21da493370N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8c16b7f2dbf2cbaf0931e21da493370N.dll,#1
  2⤵
  PID:3260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads