5bfb1237443e270d7297a9bb2d4cc44cbc4f3ad0f71db00012a4cc0ae461e6d2 | Triage™

Analysis

max time kernel
167s
max time network
179s
platform
windows10_x64
resource
win10-en-20211208
submitted
24/01/2022, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5bfb1237443e270d7297a9bb2d4cc44cbc4f3ad0f71db00012a4cc0ae461e6d2.dll
Size 164KB
Sample220124-ce8praaabp
SHA256 5bfb1237443e270d7297a9bb2d4cc44cbc4f3ad0f71db00012a4cc0ae461e6d2
MD5 8b24ea434d60f99e1ff50810fb8d28da
SHA1 259f3974763f09d57129b3881b427fd9d30358d8
SHA512 aed4d982bc7b4513abf5ba237f562cca1332a2997c8826c81a262fddd64de9074f073f88aecd03ae901d58f9e677cdf5c59f61222606fa5e7da20ade96776371
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 652	3936	rundll32.exe	69
PID 3936 wrote to memory of 652	3936	rundll32.exe	69
PID 3936 wrote to memory of 652	3936	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bfb1237443e270d7297a9bb2d4cc44cbc4f3ad0f71db00012a4cc0ae461e6d2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bfb1237443e270d7297a9bb2d4cc44cbc4f3ad0f71db00012a4cc0ae461e6d2.dll,#1
  2⤵
  PID:652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads