bc5eab9035807d258b611c670dbc460e72b99b22c65bc13dde5e3a2c4c8c9613 | Triage™

Analysis

max time kernel
135s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
09/04/2022, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bc5eab9035807d258b611c670dbc460e72b99b22c65bc13dde5e3a2c4c8c9613.dll
Size 96KB
Sample220409-weksgafegp
SHA256 bc5eab9035807d258b611c670dbc460e72b99b22c65bc13dde5e3a2c4c8c9613
MD5 721f31a2cfa45743fbbe5d65d907a254
SHA1 dc17bf82ddd688e93af709465a171cc275dc6ba1
SHA512 321701c11d0d450a0324483e16ab824b607cb4eef9bfa9c580e250bc23c5a82a605c913d24544175f893dcea102a789ff88172f3224ba6586af31c801828667f
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1728	1160	rundll32.exe	79
PID 1160 wrote to memory of 1728	1160	rundll32.exe	79
PID 1160 wrote to memory of 1728	1160	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc5eab9035807d258b611c670dbc460e72b99b22c65bc13dde5e3a2c4c8c9613.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc5eab9035807d258b611c670dbc460e72b99b22c65bc13dde5e3a2c4c8c9613.dll,#1
  2⤵
  PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads