5a5dc133c22d084e20b4d2ebd9a45fec3643f4e08ecbd627ea79e2eb1984b67d | Triage™

Analysis

max time kernel
133s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12/07/2022, 07:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5a5dc133c22d084e20b4d2ebd9a45fec3643f4e08ecbd627ea79e2eb1984b67d.dll
Size 686KB
Sample220712-hvcvxafcfp
SHA256 5a5dc133c22d084e20b4d2ebd9a45fec3643f4e08ecbd627ea79e2eb1984b67d
MD5 2e55346926ea3aa912e14a4f92364a64
SHA1 30d30e4fffa867ead9318dd6c0358133ff49258e
SHA512 5d95297012c7248e61b3d48df065b28643456e1ad0cec040945e575234fcc8ebbcbe08c4052a0831191155058a71ef4582037fb54914ece382f13240de02f38f
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 4088	924	rundll32.exe	81
PID 924 wrote to memory of 4088	924	rundll32.exe	81
PID 924 wrote to memory of 4088	924	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a5dc133c22d084e20b4d2ebd9a45fec3643f4e08ecbd627ea79e2eb1984b67d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a5dc133c22d084e20b4d2ebd9a45fec3643f4e08ecbd627ea79e2eb1984b67d.dll,#1
  2⤵
  PID:4088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4088-131-0x0000000000E80000-0x0000000000F2E000-memory.dmp

Download