5bc4c237a9be6338038f9afe72915d6fa11f788c1d5ce684c8aaa0a4f4c0303f | Triage

Analysis

max time kernel
84s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 05:03

Sharing

Report Analysis Logs

General

Target

5bc4c237a9be6338038f9afe72915d6fa11f788c1d5ce684c8aaa0a4f4c0303f.dll
Size

3KB
MD5

1104e6df056730bdf56cdf150d5733f5
SHA1

0d8dde096534bb15d74256e16ca7bd10c3379753
SHA256

5bc4c237a9be6338038f9afe72915d6fa11f788c1d5ce684c8aaa0a4f4c0303f
SHA512

f85920e58fb942a8ff015769399989551ec4ae3dc1ccae05e3612b3809b571bd413ebe3dd74fd625fc85a82c047220bd2968f11250917a778a6e0d1cd1fa71bc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 2328	1532	rundll32.exe	83
PID 1532 wrote to memory of 2328	1532	rundll32.exe	83
PID 1532 wrote to memory of 2328	1532	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bc4c237a9be6338038f9afe72915d6fa11f788c1d5ce684c8aaa0a4f4c0303f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bc4c237a9be6338038f9afe72915d6fa11f788c1d5ce684c8aaa0a4f4c0303f.dll,#1
  2⤵
  PID:2328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads