f8cc2cf36e193774f13c9c5f23ab777496dcd7ca588f4f73b45a7a5ffa96145e | Triage

Analysis

max time kernel
146s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
26-06-2022 05:20

Sharing

Report Analysis Logs

General

Target

auth.dll
Size

401KB
MD5

95159f5427c976d28c86aa716799e6de
SHA1

4bfbf8c48f17a7c7269dfc314e5e5bd166db857f
SHA256

f8cc2cf36e193774f13c9c5f23ab777496dcd7ca588f4f73b45a7a5ffa96145e
SHA512

04af830cecd7ec8bf5d2f637a0e52036800d171f8d74f837648bd2129f8d19385fa46ae39c4cb0fc47c03aaa32d17f8739661d8b57b0d3d74532de29fc20f629

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1376	1468	rundll32.exe	80
PID 1468 wrote to memory of 1376	1468	rundll32.exe	80
PID 1468 wrote to memory of 1376	1468	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\auth.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\auth.dll,#1
  2⤵
  PID:1376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads