0d8716561e8a1b07f80252c55963f4af7b7008579953ee9bf60c59ef3a6f6b61 | Triage

Analysis

max time kernel
116s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
29-05-2022 17:06

Sharing

Report Analysis Logs

General

Target

0d8716561e8a1b07f80252c55963f4af7b7008579953ee9bf60c59ef3a6f6b61.dll
Size

164KB
MD5

28126fc899a3f0e9befb44376e097d54
SHA1

14d0411ad11b808277d5e59dea37539a6d22ae56
SHA256

0d8716561e8a1b07f80252c55963f4af7b7008579953ee9bf60c59ef3a6f6b61
SHA512

535be9140cad98bc118aabab5f07e4689cf7738ea289a32746b7d769931f6979d2e2a6b6a30c49824406f757970e64133435b7e88637104b1ab019051f33bfdf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4684 wrote to memory of 1428	4684	rundll32.exe	rundll32.exe
PID 4684 wrote to memory of 1428	4684	rundll32.exe	rundll32.exe
PID 4684 wrote to memory of 1428	4684	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d8716561e8a1b07f80252c55963f4af7b7008579953ee9bf60c59ef3a6f6b61.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4684

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d8716561e8a1b07f80252c55963f4af7b7008579953ee9bf60c59ef3a6f6b61.dll,#1
2⤵
PID:1428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1428-130-0x0000000000000000-mapping.dmp

Download