691c3d2ee738e5dae9f1f77d332b32a4f852a273d4d35e71531ea4a397bbec44 | Triage

Analysis

max time kernel
105s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 08:05

Sharing

Report Analysis Logs

General

Target

81ca33698bb4c36c2da29a384f3e5a70N.dll
Size

5KB
MD5

81ca33698bb4c36c2da29a384f3e5a70
SHA1

6c4199fee0987d849c1316b25d565cf42b5c2fd9
SHA256

691c3d2ee738e5dae9f1f77d332b32a4f852a273d4d35e71531ea4a397bbec44
SHA512

bd177b5730d7e93b13c0cafe01bb3e8088f389642c077f21c3c385ff6430a48265acc709c947342fae1d6c709f29c6f8b6b88a0d68f293b50cbe96f6203a5249
SSDEEP

96:nEY2RrF1eqwi4aLOiAMU9WUnvdsOsdGF16lp0:EHRh1eppwOf9WUnkdGQp0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 752	1172	rundll32.exe	84
PID 1172 wrote to memory of 752	1172	rundll32.exe	84
PID 1172 wrote to memory of 752	1172	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\81ca33698bb4c36c2da29a384f3e5a70N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\81ca33698bb4c36c2da29a384f3e5a70N.dll,#1
  2⤵
  PID:752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads