9e861f282623eca8634fb8e0486661f06f96b5f0d0ca5ee48ddc4bfa9b86cb36 | Triage™

Analysis

max time kernel
91s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
09/07/2022, 07:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9e861f282623eca8634fb8e0486661f06f96b5f0d0ca5ee48ddc4bfa9b86cb36.dll
Size 670KB
Sample220709-h1hckscfgl
SHA256 9e861f282623eca8634fb8e0486661f06f96b5f0d0ca5ee48ddc4bfa9b86cb36
MD5 a177c3d97014f37d9f5c9514a796180a
SHA1 7e437cc4a8074910895969347667bc1fd53df1d6
SHA512 3fe35944c2c983c9279f75b6772e6eec80eb49ab5b8d5fdd41e7abfdb2f4e26f0b396ad5693c5836e3a38975db64cb08b2892a2811455276586b85ba0ebf84c0
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 3212	4236	rundll32.exe	81
PID 4236 wrote to memory of 3212	4236	rundll32.exe	81
PID 4236 wrote to memory of 3212	4236	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e861f282623eca8634fb8e0486661f06f96b5f0d0ca5ee48ddc4bfa9b86cb36.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e861f282623eca8634fb8e0486661f06f96b5f0d0ca5ee48ddc4bfa9b86cb36.dll,#1
  2⤵
  PID:3212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3212-131-0x0000000002200000-0x00000000022AA000-memory.dmp

Download