6bbdca71c31aa6ed155d3df5230a1e5b0390ba1170a4b27424742d558707b558 | Triage

Analysis

max time kernel
158s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 04:50

Sharing

Report Analysis Logs

General

Target

6bbdca71c31aa6ed155d3df5230a1e5b0390ba1170a4b27424742d558707b558.dll
Size

3KB
MD5

f4c92bceb9c003cdfd3ad69e2ab70062
SHA1

819fc068f4eeefc7b49650c406569021a813c84d
SHA256

6bbdca71c31aa6ed155d3df5230a1e5b0390ba1170a4b27424742d558707b558
SHA512

374519228cd00cd0985893fd7333bc17065648745fc138743a0d8ff6b70cf04ebd002f0d7e2d14c299030d27bab8f8de1caa70b4c4656bf005d8e1024f61b862

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 3604	2996	rundll32.exe	79
PID 2996 wrote to memory of 3604	2996	rundll32.exe	79
PID 2996 wrote to memory of 3604	2996	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6bbdca71c31aa6ed155d3df5230a1e5b0390ba1170a4b27424742d558707b558.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6bbdca71c31aa6ed155d3df5230a1e5b0390ba1170a4b27424742d558707b558.dll,#1
  2⤵
  PID:3604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads