dc6539e553d578eef069fcebd0743c958eb5e0d2cf0cb74cbfb9b63954d0b532 | Triage

Analysis

max time kernel
119s
max time network
161s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 00:53

Sharing

Report Analysis Logs

General

Target

dc6539e553d578eef069fcebd0743c958eb5e0d2cf0cb74cbfb9b63954d0b532.dll
Size

164KB
MD5

18c865a19580f48110fc2e8ae697e6bd
SHA1

90fc85cd1eab5168572aa6606a6c90999ee0deea
SHA256

dc6539e553d578eef069fcebd0743c958eb5e0d2cf0cb74cbfb9b63954d0b532
SHA512

aace17fd430c0cd8256489bf550b09dbd1281933896e5301eb9a094b82e6062c1417894928ce4c68503db85aa24803e743fbf9d321e936ad8d41a793392696f0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3480 wrote to memory of 660	3480	rundll32.exe	rundll32.exe
PID 3480 wrote to memory of 660	3480	rundll32.exe	rundll32.exe
PID 3480 wrote to memory of 660	3480	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dc6539e553d578eef069fcebd0743c958eb5e0d2cf0cb74cbfb9b63954d0b532.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3480

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dc6539e553d578eef069fcebd0743c958eb5e0d2cf0cb74cbfb9b63954d0b532.dll,#1
2⤵
PID:660

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...