a08fa77833ace89dbc789d804f9f5632fec0b64a301567e07f495e98c33bee42 | Triage

Analysis

max time kernel
103s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
19-03-2022 18:00

Sharing

Report Analysis Logs

General

Target

a08fa77833ace89dbc789d804f9f5632fec0b64a301567e07f495e98c33bee42.dll
Size

437KB
MD5

afe7a69ba07d6d8c7779b8d99277a87c
SHA1

fa203f36e976c3ef1fbad3c9b5a55117497e5768
SHA256

a08fa77833ace89dbc789d804f9f5632fec0b64a301567e07f495e98c33bee42
SHA512

d347c0169a0edb846ac11b49b28b709327917e3e35d36ccc356b9377ee72982926485e1895797ac599a347782fcdcc1e1511352461138bc2a617c9da437ccef3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2820 wrote to memory of 3684	2820	rundll32.exe	rundll32.exe
PID 2820 wrote to memory of 3684	2820	rundll32.exe	rundll32.exe
PID 2820 wrote to memory of 3684	2820	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a08fa77833ace89dbc789d804f9f5632fec0b64a301567e07f495e98c33bee42.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a08fa77833ace89dbc789d804f9f5632fec0b64a301567e07f495e98c33bee42.dll,#1
  2⤵
  PID:3684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3684-130-0x0000000000E80000-0x0000000000EA2000-memory.dmp

Filesize
136KB

Download
memory/3684-131-0x0000000010000000-0x000000001006E000-memory.dmp

Filesize
440KB

Download