92819abc5959ef5dcdec4ad5ffc638e8492d0deec4569fc9cef2501adec5474a | Triage

Analysis

max time kernel
59s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
01-02-2022 05:03

Sharing

Report Analysis Logs

General

Target

92819abc5959ef5dcdec4ad5ffc638e8492d0deec4569fc9cef2501adec5474a.dll
Size

276KB
MD5

bbfa105715b98f8de465c8afcb4130ef
SHA1

b73c7aed91aa18f558b1a9a378fea4e5535bdf4c
SHA256

92819abc5959ef5dcdec4ad5ffc638e8492d0deec4569fc9cef2501adec5474a
SHA512

ca8279c7b22805a19a02ea7a2793db800b987f9554233df2a709a3c136c8cf89c8c6d6944b05c5f09d0e39628ce39fd43a2861c83772a1cd2a9205401a3c214d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4804 wrote to memory of 4736	4804	rundll32.exe	rundll32.exe
PID 4804 wrote to memory of 4736	4804	rundll32.exe	rundll32.exe
PID 4804 wrote to memory of 4736	4804	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92819abc5959ef5dcdec4ad5ffc638e8492d0deec4569fc9cef2501adec5474a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4804

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92819abc5959ef5dcdec4ad5ffc638e8492d0deec4569fc9cef2501adec5474a.dll,#1
2⤵
PID:4736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...