bd3310cc58bd96b65d278fdf5082719840a58f07c307c224e32c67d4d01d1fc0 | Triage

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 00:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

36a4d203ceba975c4ae02be69832beb0N.dll
Size

6KB
MD5

36a4d203ceba975c4ae02be69832beb0
SHA1

5dee72039fcc5309625d1d8f127748d7c8b46651
SHA256

bd3310cc58bd96b65d278fdf5082719840a58f07c307c224e32c67d4d01d1fc0
SHA512

27e8d2bd3f55686bc3c067f2c41f56cdc5e173a037e88a7020a952999b25dbe31e79ae6240e82cc4807f8adce86a16c25ac10f7bf835926146efac5139672394
SSDEEP

96:hy859x0P8MawB0WqTScO7kGEpBTeiHp/BxoTGyB:F5oLRQDaceDTGa

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 1536	1400	rundll32.exe	84
PID 1400 wrote to memory of 1536	1400	rundll32.exe	84
PID 1400 wrote to memory of 1536	1400	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36a4d203ceba975c4ae02be69832beb0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\36a4d203ceba975c4ae02be69832beb0N.dll,#1
  2⤵
  PID:1536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads