5a5dc133c22d084e20b4d2ebd9a45fec3643f4e08ecbd627ea79e2eb1984b67d | Triage

Analysis

max time kernel
133s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12-07-2022 07:03

Sharing

Report Analysis Logs

General

Target

5a5dc133c22d084e20b4d2ebd9a45fec3643f4e08ecbd627ea79e2eb1984b67d.dll
Size

686KB
MD5

2e55346926ea3aa912e14a4f92364a64
SHA1

30d30e4fffa867ead9318dd6c0358133ff49258e
SHA256

5a5dc133c22d084e20b4d2ebd9a45fec3643f4e08ecbd627ea79e2eb1984b67d
SHA512

5d95297012c7248e61b3d48df065b28643456e1ad0cec040945e575234fcc8ebbcbe08c4052a0831191155058a71ef4582037fb54914ece382f13240de02f38f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 924 wrote to memory of 4088	924	rundll32.exe	rundll32.exe
PID 924 wrote to memory of 4088	924	rundll32.exe	rundll32.exe
PID 924 wrote to memory of 4088	924	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a5dc133c22d084e20b4d2ebd9a45fec3643f4e08ecbd627ea79e2eb1984b67d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:924

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a5dc133c22d084e20b4d2ebd9a45fec3643f4e08ecbd627ea79e2eb1984b67d.dll,#1
2⤵
PID:4088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4088-130-0x0000000000000000-mapping.dmp

Download
memory/4088-131-0x0000000000E80000-0x0000000000F2E000-memory.dmp

Filesize
696KB

Download