ccb8e17d3df37549a3dbdb31f3b5e03b8fbb3ddf9462cf962518c8e0312cdb56 | Triage

Analysis

max time kernel
33s
max time network
75s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
01-02-2022 09:13

Sharing

Report Analysis Logs

General

Target

ccb8e17d3df37549a3dbdb31f3b5e03b8fbb3ddf9462cf962518c8e0312cdb56.dll
Size

246KB
MD5

d871aee05301c265725e006800294894
SHA1

3b6d944433e24d2eb9606f8d4bfc882ba505c4d6
SHA256

ccb8e17d3df37549a3dbdb31f3b5e03b8fbb3ddf9462cf962518c8e0312cdb56
SHA512

83508d1a3e08a584e0fa4b7b7f3dc87ee4bce48eea83e6d009baf92041bd3ce8eb6ee6132f768fcd54168c1c7b845e1ef62e537471a2f3a323b79c3e0858ecc5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4188 wrote to memory of 4256	4188	rundll32.exe	rundll32.exe
PID 4188 wrote to memory of 4256	4188	rundll32.exe	rundll32.exe
PID 4188 wrote to memory of 4256	4188	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccb8e17d3df37549a3dbdb31f3b5e03b8fbb3ddf9462cf962518c8e0312cdb56.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4188

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccb8e17d3df37549a3dbdb31f3b5e03b8fbb3ddf9462cf962518c8e0312cdb56.dll,#1
2⤵
PID:4256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...