e6af534b1dbee86e294e4110dd70a1dd089feef0c7e4c9946abac7b988fe7763 | Triage™

Analysis

max time kernel
120s
max time network
151s
platform
windows10_x64
resource
win10-en-20211208
submitted
24/01/2022, 00:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e6af534b1dbee86e294e4110dd70a1dd089feef0c7e4c9946abac7b988fe7763.dll
Size 116KB
Sample220124-a5t8yahab2
SHA256 e6af534b1dbee86e294e4110dd70a1dd089feef0c7e4c9946abac7b988fe7763
MD5 702a5f7d6573f99ae843fd158e46b645
SHA1 f0c2ee326177d951cddec0ac67a0234cb88301e5
SHA512 d766377d0c6022aab88ff070a7959a49c740c43c799230a65e8c3a221c034413e397bbdfd8848bcab5b9df1feff72f4f3ced37ed72b0088df699367196800d1d
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2772	2728	rundll32.exe	69
PID 2728 wrote to memory of 2772	2728	rundll32.exe	69
PID 2728 wrote to memory of 2772	2728	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e6af534b1dbee86e294e4110dd70a1dd089feef0c7e4c9946abac7b988fe7763.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e6af534b1dbee86e294e4110dd70a1dd089feef0c7e4c9946abac7b988fe7763.dll,#1
  2⤵
  PID:2772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads