c3ca95d1ffbcc03b2759edd3d14705f56e32f0bd88e051686ee1e78ae03ec0b9 | Triage

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
25-06-2022 03:12

Sharing

Report Analysis Logs

General

Target

c3ca95d1ffbcc03b2759edd3d14705f56e32f0bd88e051686ee1e78ae03ec0b9.dll
Size

153KB
MD5

bcb2cb4b1013272f4ffd5b4a572d1ba4
SHA1

10088466c6a991a67a71392ec93d3cdfc6e5864f
SHA256

c3ca95d1ffbcc03b2759edd3d14705f56e32f0bd88e051686ee1e78ae03ec0b9
SHA512

e114319901c27d7587e68ca44d5cda9f12ce59b719ad080811ac07de765325c692edd341cea6dd9f75ba80de620e0ce9a2fbc61c060f45ee1a8af3f32936a0e8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 4772	4756	rundll32.exe	79
PID 4756 wrote to memory of 4772	4756	rundll32.exe	79
PID 4756 wrote to memory of 4772	4756	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3ca95d1ffbcc03b2759edd3d14705f56e32f0bd88e051686ee1e78ae03ec0b9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3ca95d1ffbcc03b2759edd3d14705f56e32f0bd88e051686ee1e78ae03ec0b9.dll,#1
  2⤵
  PID:4772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads