701f00df01347389b263cd50cd6b4e86669704503011732a9ce0fbd71baaa00e | Triage

Analysis

max time kernel
159s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
08-07-2022 14:21

Sharing

Report Analysis Logs

General

Target

701f00df01347389b263cd50cd6b4e86669704503011732a9ce0fbd71baaa00e.dll
Size

1.8MB
MD5

d7aceb8a882d4d181ba658d4f4c48123
SHA1

4d187b3df5575f0c68986bd7c5eb95b50e7f40e4
SHA256

701f00df01347389b263cd50cd6b4e86669704503011732a9ce0fbd71baaa00e
SHA512

29e2d226bed25374ec28502f5d193824f3504c4d698a7ec7acdd2ca8af9b786fcb6c6d96e03db1d040cbd43e884d4b75f1ee511142b671e585e52de7f2e743e4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4912 wrote to memory of 4204	4912	rundll32.exe	rundll32.exe
PID 4912 wrote to memory of 4204	4912	rundll32.exe	rundll32.exe
PID 4912 wrote to memory of 4204	4912	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\701f00df01347389b263cd50cd6b4e86669704503011732a9ce0fbd71baaa00e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4912

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\701f00df01347389b263cd50cd6b4e86669704503011732a9ce0fbd71baaa00e.dll,#1
2⤵
PID:4204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4204-130-0x0000000000000000-mapping.dmp

Download