e14b5e3e0e463d43cc28fc76ef2c26b1ea0baecabfb2467241bd14d937ec4edd | Triage

Analysis

max time kernel
83s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
28-02-2022 10:24

Sharing

Report Analysis Logs

General

Target

a6b262fd9c0632265b09d7a0188c32d0e5042487368467e9e73ac0fbd3b56fae.dll
Size

1.3MB
MD5

69b5df6ca9fb51a4b225f3bf8e872a8e
SHA1

1d042cd3e47acddb39c98c16c7d669f629e9d159
SHA256

a6b262fd9c0632265b09d7a0188c32d0e5042487368467e9e73ac0fbd3b56fae
SHA512

7b6fc2d006e5ad47f5c6b4a7322258db4b28440a2e83eb004d51541c831269a071da14460e91786b36e89d73da1666c07130628b1887e3920ec28ba3d5cee59b

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

58 556 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4064 wrote to memory of 556	4064	rundll32.exe	rundll32.exe
PID 4064 wrote to memory of 556	4064	rundll32.exe	rundll32.exe
PID 4064 wrote to memory of 556	4064	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6b262fd9c0632265b09d7a0188c32d0e5042487368467e9e73ac0fbd3b56fae.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4064

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6b262fd9c0632265b09d7a0188c32d0e5042487368467e9e73ac0fbd3b56fae.dll,#1
2⤵
- Blocklisted process makes network request
PID:556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...