a8a1e59e5bb04ac6e7c422a105a6816bc0e1c6755b7902bc670d1cf2bcbeca53 | Triage™

Analysis

max time kernel
91s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
09/03/2022, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8691152.dll
Size 1.4MB
Sample220309-vre73sbab7
SHA256 a8a1e59e5bb04ac6e7c422a105a6816bc0e1c6755b7902bc670d1cf2bcbeca53
MD5 63d8ab9a1d3fda09a0f9374fc344c400
SHA1 31532e49f247eacfd9e6a36f691323c17f321062
SHA512 2e2e97fa6747e599f83d2a482383aee92bb9adc16b1f19ecac8c66060e5c6f2a0e4185217fb9138546948e1701230ac3ef1959a063b4e01ac6cae243221dc7d9
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 784	4084	rundll32.exe	55
PID 4084 wrote to memory of 784	4084	rundll32.exe	55
PID 4084 wrote to memory of 784	4084	rundll32.exe	55

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8691152.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8691152.dll,#1
  2⤵
  PID:784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/784-131-0x0000000004BA0000-0x0000000004D13000-memory.dmp

Download

memory/784-132-0x0000000004E40000-0x0000000004E41000-memory.dmp

Download