bef12d75ed3da68825239fd5b56783ecf9b1e1250be7f169db445af6afa6cced | Triage

Analysis

max time kernel
101s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2024 09:25

Sharing

Report Analysis Logs

General

Target

a34246d6d5f02634b38ab6c76033dbb0N.dll
Size

7KB
MD5

a34246d6d5f02634b38ab6c76033dbb0
SHA1

7a719135a5cacbe648eeed08946ea0fde53b0572
SHA256

bef12d75ed3da68825239fd5b56783ecf9b1e1250be7f169db445af6afa6cced
SHA512

9c885390f4a0e3074e25793f12206a366e3157c223a16efbfdf2fa2f3660c06af4cf25afe297f4d3785cf952b97972955664fbe7c1311dba9b4a759fa48c582b
SSDEEP

96:VGEETrMLH5HLD1faHCE1Msa/fJ58Mob7eCv+UE4Xw:efM5LDAva/hxS+Liw

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1364	1684	rundll32.exe	83
PID 1684 wrote to memory of 1364	1684	rundll32.exe	83
PID 1684 wrote to memory of 1364	1684	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a34246d6d5f02634b38ab6c76033dbb0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a34246d6d5f02634b38ab6c76033dbb0N.dll,#1
  2⤵
  PID:1364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads