1e2ba5b412c976f206990ff1ea4f0d7467f3adadaefa3ab44f07d71af4d52262 | Triage™

Analysis

max time kernel
121s
max time network
163s
platform
windows10_x64
resource
win10-en-20211208
submitted
25/01/2022, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1e2ba5b412c976f206990ff1ea4f0d7467f3adadaefa3ab44f07d71af4d52262.dll
Size 301KB
Sample220125-mteekaeed2
SHA256 1e2ba5b412c976f206990ff1ea4f0d7467f3adadaefa3ab44f07d71af4d52262
MD5 c3d6dc41c06570db7a2c19773ef8bbf3
SHA1 822b6558b830afbf041f5b97d533b402cd2b4c29
SHA512 fcd2eb377a29a2808e303f1f454b9dd02a946cd49dfed956c956eaffd75cf766d227a13b745e2a12fb4ca62d442824b55e55bc02dcf05a1622c8cc269b4d9c3d
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 1276	380	rundll32.exe	69
PID 380 wrote to memory of 1276	380	rundll32.exe	69
PID 380 wrote to memory of 1276	380	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e2ba5b412c976f206990ff1ea4f0d7467f3adadaefa3ab44f07d71af4d52262.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e2ba5b412c976f206990ff1ea4f0d7467f3adadaefa3ab44f07d71af4d52262.dll,#1
  2⤵
  PID:1276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads