c2feddc5f9ca82ca55e5c8eade7be0ecd319118de5c22d7e2b6ed0823adea4d6 | Triage

Analysis

max time kernel
94s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 10:03

Sharing

Report Analysis Logs

General

Target

a3e656ca79419fe9c3abb474ec926230N.dll
Size

16KB
MD5

a3e656ca79419fe9c3abb474ec926230
SHA1

248369b2b6aef9a136fa2634bca43b7ec4e95798
SHA256

c2feddc5f9ca82ca55e5c8eade7be0ecd319118de5c22d7e2b6ed0823adea4d6
SHA512

adfb9abfaecb326ac54db1da405d5ec839c8a25455761abd113acc4462d48ed537dc9ce0e5436cfdc888b6c166e98cde0bba7067cb8c10e9140e8925474ac6d4
SSDEEP

384:LtT0SWA7/GXmpUNn4iRZhAG4WvYwUmztjbRKV:JT0qmznB6rwUmRvRY

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 4616	1528	rundll32.exe	83
PID 1528 wrote to memory of 4616	1528	rundll32.exe	83
PID 1528 wrote to memory of 4616	1528	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3e656ca79419fe9c3abb474ec926230N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3e656ca79419fe9c3abb474ec926230N.dll,#1
  2⤵
  PID:4616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4616-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4616-2-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download