33eb3f51a6c95cfaef410913cf7be0843ca6493838f07cd3ac5b21a02513c6d4 | Triage

Analysis

max time kernel
133s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 05:02

Sharing

Report Analysis Logs

General

Target

33eb3f51a6c95cfaef410913cf7be0843ca6493838f07cd3ac5b21a02513c6d4.dll
Size

3KB
MD5

4962a276d50fddc566fec98c9ecebf01
SHA1

232c1c15943d4165130b040b7c6e6efa4b21d4b4
SHA256

33eb3f51a6c95cfaef410913cf7be0843ca6493838f07cd3ac5b21a02513c6d4
SHA512

cd68f92fb5fd9e97ab342d6303d1239f02076c6eed0a162cd0420b647f31992e23128999a276f999d8da75d7419cad1a420913c8194433860c10159325dfef9a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2860	3004	rundll32.exe	83
PID 3004 wrote to memory of 2860	3004	rundll32.exe	83
PID 3004 wrote to memory of 2860	3004	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33eb3f51a6c95cfaef410913cf7be0843ca6493838f07cd3ac5b21a02513c6d4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\33eb3f51a6c95cfaef410913cf7be0843ca6493838f07cd3ac5b21a02513c6d4.dll,#1
  2⤵
  PID:2860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads