e12750e54fce9f38531b739c6c8297aa3cc5abc20fb284984c7d2b121c2b1b13 | Triage

Analysis

max time kernel
165s
max time network
171s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 00:51

Sharing

Report Analysis Logs

General

Target

e12750e54fce9f38531b739c6c8297aa3cc5abc20fb284984c7d2b121c2b1b13.dll
Size

166KB
MD5

4faaa4012226c9244f21d64204c9c4ff
SHA1

b782df23b2caa7d4d969831dd3f006c7be973b4c
SHA256

e12750e54fce9f38531b739c6c8297aa3cc5abc20fb284984c7d2b121c2b1b13
SHA512

5d6fc65eb90dbf93319e46200444021fa8f35fa8ff6eed695885f8dd929799f96ad466f85a5f3ba01fda119ac2846f56f371cdc7f58cdc92ced50452c6df5c92

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2712 wrote to memory of 2756	2712	rundll32.exe	rundll32.exe
PID 2712 wrote to memory of 2756	2712	rundll32.exe	rundll32.exe
PID 2712 wrote to memory of 2756	2712	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e12750e54fce9f38531b739c6c8297aa3cc5abc20fb284984c7d2b121c2b1b13.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2712

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e12750e54fce9f38531b739c6c8297aa3cc5abc20fb284984c7d2b121c2b1b13.dll,#1
2⤵
PID:2756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...