46d6ef284b4d9b1494d0ae00f7ddc1abb43e4a748373fdfd2c9957e4c29b35e4 | Triage

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 04:48

Sharing

Report Analysis Logs

General

Target

46d6ef284b4d9b1494d0ae00f7ddc1abb43e4a748373fdfd2c9957e4c29b35e4.dll
Size

3KB
MD5

ef52827d758581317a7da8bf39723b3f
SHA1

9e1da50274d294c449b25047ac77c030c44438a8
SHA256

46d6ef284b4d9b1494d0ae00f7ddc1abb43e4a748373fdfd2c9957e4c29b35e4
SHA512

758e51bb7aacd6bf0b6ecd4bc41786b3a686986ce4a3bf1de53521d6e21d3183748895f179213a3cb9312109525c84d07759a53287f8ffd011642dde708e140b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 2264	5008	rundll32.exe	80
PID 5008 wrote to memory of 2264	5008	rundll32.exe	80
PID 5008 wrote to memory of 2264	5008	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46d6ef284b4d9b1494d0ae00f7ddc1abb43e4a748373fdfd2c9957e4c29b35e4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\46d6ef284b4d9b1494d0ae00f7ddc1abb43e4a748373fdfd2c9957e4c29b35e4.dll,#1
  2⤵
  PID:2264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads