9b19a0aedb6e1e6b2832b08dc02056c66aacc5d62f93d2807632e47ae8d16d26 | Triage

Analysis

max time kernel
74s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12-07-2022 07:03

Sharing

Report Analysis Logs

General

Target

9b19a0aedb6e1e6b2832b08dc02056c66aacc5d62f93d2807632e47ae8d16d26.dll
Size

686KB
MD5

5eac5633bdd7c15c3230a349a76882f5
SHA1

b997cbd54fd1a2c76c00d21e3a012697367a68f6
SHA256

9b19a0aedb6e1e6b2832b08dc02056c66aacc5d62f93d2807632e47ae8d16d26
SHA512

d884656644bac8c60a1bee74b9cc9b7d60b4a1607902a5ba1e858f12e819cf1092abb1d1d658d07928576076d70d5f618d8c095ea41a5dc668c01cd966a58c8d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4628 wrote to memory of 4476	4628	rundll32.exe	rundll32.exe
PID 4628 wrote to memory of 4476	4628	rundll32.exe	rundll32.exe
PID 4628 wrote to memory of 4476	4628	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b19a0aedb6e1e6b2832b08dc02056c66aacc5d62f93d2807632e47ae8d16d26.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4628

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b19a0aedb6e1e6b2832b08dc02056c66aacc5d62f93d2807632e47ae8d16d26.dll,#1
2⤵
PID:4476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4476-130-0x0000000000000000-mapping.dmp

Download