ff40a88739c47c64fc1445223d8d79f5ad1e656a86d795fa9908cd1b0b17a06c | Triage

Analysis

max time kernel
109s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2024 18:50

Sharing

Report Analysis Logs

General

Target

fe055f8c9a737605f2c4d8624d2b3810N.dll
Size

6KB
MD5

fe055f8c9a737605f2c4d8624d2b3810
SHA1

8bd1f68e4c09bd9ad8c7d9d4af62b3532ba030af
SHA256

ff40a88739c47c64fc1445223d8d79f5ad1e656a86d795fa9908cd1b0b17a06c
SHA512

12f407cc0d0cf5fa2f527c34b424e099fae984ff62e592304c68f70dee5f953f8dd4d99053e5b75c85abfcd22e42e0d9ae3939572fe8f303e1c326ad08b3ac24
SSDEEP

96:hy859x0P8MaqMoKmFS4NYNMX+SDfb6laAyhfjVJqVn7GC:F5oLGPmFS4NYu1fLzhm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 4772	3300	rundll32.exe	84
PID 3300 wrote to memory of 4772	3300	rundll32.exe	84
PID 3300 wrote to memory of 4772	3300	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe055f8c9a737605f2c4d8624d2b3810N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe055f8c9a737605f2c4d8624d2b3810N.dll,#1
  2⤵
  PID:4772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads