e12750e54fce9f38531b739c6c8297aa3cc5abc20fb284984c7d2b121c2b1b13 | Triage™

Analysis

max time kernel
165s
max time network
171s
platform
windows10_x64
resource
win10-en-20211208
submitted
24/01/2022, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e12750e54fce9f38531b739c6c8297aa3cc5abc20fb284984c7d2b121c2b1b13.dll
Size 166KB
Sample220124-a7f44ahad7
SHA256 e12750e54fce9f38531b739c6c8297aa3cc5abc20fb284984c7d2b121c2b1b13
MD5 4faaa4012226c9244f21d64204c9c4ff
SHA1 b782df23b2caa7d4d969831dd3f006c7be973b4c
SHA512 5d6fc65eb90dbf93319e46200444021fa8f35fa8ff6eed695885f8dd929799f96ad466f85a5f3ba01fda119ac2846f56f371cdc7f58cdc92ced50452c6df5c92
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2756	2712	rundll32.exe	68
PID 2712 wrote to memory of 2756	2712	rundll32.exe	68
PID 2712 wrote to memory of 2756	2712	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e12750e54fce9f38531b739c6c8297aa3cc5abc20fb284984c7d2b121c2b1b13.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e12750e54fce9f38531b739c6c8297aa3cc5abc20fb284984c7d2b121c2b1b13.dll,#1
  2⤵
  PID:2756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads