212698d01b08f3d7a92fe586cb3381e584bbb5709d57937b64c20334b1cf3a3d | Triage

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 01:03

Sharing

Report Analysis Logs

General

Target

212698d01b08f3d7a92fe586cb3381e584bbb5709d57937b64c20334b1cf3a3d.dll
Size

3KB
MD5

6feb1ab84e5f9aad409b1198a3a3f0d0
SHA1

9ff00a71fdd4f5f2db025fd873998301487c71ca
SHA256

212698d01b08f3d7a92fe586cb3381e584bbb5709d57937b64c20334b1cf3a3d
SHA512

df0007f9e7c4329ee53b1b1e443273a690b4935163259d7a3cf5210587e2da3d2f545514e091dfc295e68aa7079dd3f78215d76b30c2baa3ee06e46b7dc1ba8e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1048	836	rundll32.exe	81
PID 836 wrote to memory of 1048	836	rundll32.exe	81
PID 836 wrote to memory of 1048	836	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\212698d01b08f3d7a92fe586cb3381e584bbb5709d57937b64c20334b1cf3a3d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\212698d01b08f3d7a92fe586cb3381e584bbb5709d57937b64c20334b1cf3a3d.dll,#1
  2⤵
  PID:1048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads