2f4dea7e545884ce6caf0455460938a7824a7acc9631bbda84f5a12ac66bab31 | Triage

Analysis

max time kernel
103s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 13:07

Sharing

Report Analysis Logs

General

Target

b4b4ec9a2843d15cce23edde30907350N.dll
Size

473KB
MD5

b4b4ec9a2843d15cce23edde30907350
SHA1

5f7e421583cd2dd20fe3cfa0b19f98a2bbf29757
SHA256

2f4dea7e545884ce6caf0455460938a7824a7acc9631bbda84f5a12ac66bab31
SHA512

5efe4831cc05f0e5dea9bbed276ab69360fe4686b4e223e0cb052c9c7a48608e967c549efc3565ee7cc6fca44476d1c01f536a806a5abd95bb5665ac90c545e5
SSDEEP

12288:dky6sOZl16q6NCJd44QkiN6yQvDuoqPERZFxzXMn:Oy6sOiPERZDX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 3476	1036	rundll32.exe	84
PID 1036 wrote to memory of 3476	1036	rundll32.exe	84
PID 1036 wrote to memory of 3476	1036	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4b4ec9a2843d15cce23edde30907350N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4b4ec9a2843d15cce23edde30907350N.dll,#1
  2⤵
  PID:3476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads