aa0bbaecb678868e1e7f57c7ca9d61b608b3d788be490790eb1d148beadf4615 | Triage

Analysis

max time kernel
91s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-09-2022 10:03

Sharing

Report Analysis Logs

General

Target

04.dll
Size

4KB
MD5

3291e1603715c47a23b60a8bf2ca73db
SHA1

41531fa6b5086e9150b57256efbcd47d7c05cd53
SHA256

aa0bbaecb678868e1e7f57c7ca9d61b608b3d788be490790eb1d148beadf4615
SHA512

4d96b69fbffeafd1a149d4689335d5fc98116ec2aa664d2da23ebf91cf9ea8e896d8dc6775f6b3a847e66eb05917882594125fe46b89a13c168073a55c9d10a8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 432	3092	rundll32.exe	81
PID 3092 wrote to memory of 432	3092	rundll32.exe	81
PID 3092 wrote to memory of 432	3092	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\04.dll,#1
  2⤵
  PID:432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/432-132-0x0000000000000000-mapping.dmp

Download
memory/432-133-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download