0ff0d7f6a67bb2daa879f111d4649231cb3bd89090085a06c9039aabc5fecb2a | Triage

Analysis

max time kernel
41s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 09:05

Sharing

Report Analysis Logs

General

Target

CLibrary.dll
Size

6.5MB
MD5

9a319ba89b9427cd2251fe2b5b2f8268
SHA1

ca95629d35f35d703acde97a9219955d24fb9dc2
SHA256

50b11d03d16c1d71072647d3a41dd4370ee356306984f467c274260f5ef13958
SHA512

af7affbedd59dad1509d820b602777d4e56fa5636112f976f843e83e98c52c8c8f7b37d6c7622483ba7113cb4de92754e72102aff25a5852e0596f171039b37c
SSDEEP

98304:v9wyQ37ksSqslMh/xM/uZzVrwQYpKPJDeg3lPq6hTa1DMn:Vh+XKC/xFhVrwQrPJ9iY

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4296 wrote to memory of 3880	4296	rundll32.exe	rundll32.exe
PID 4296 wrote to memory of 3880	4296	rundll32.exe	rundll32.exe
PID 4296 wrote to memory of 3880	4296	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CLibrary.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4296

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CLibrary.dll,#1
2⤵
PID:3880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...