9259c384261f465a4fd9d3b39e440851f620fce9c5fcb983b6963a50371158cb | Triage

Analysis

max time kernel
97s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 07:00

Sharing

Report Analysis Logs

General

Target

9259c384261f465a4fd9d3b39e440851f620fce9c5fcb983b6963a50371158cb.dll
Size

3KB
MD5

47e1f9589c58005c0e1975886ee85868
SHA1

fc89928df11afb73140ab236aab493d027dbc1a3
SHA256

9259c384261f465a4fd9d3b39e440851f620fce9c5fcb983b6963a50371158cb
SHA512

d9f0781ee07f8322b537650825354c0a79a4d2bd3c3d769fc53d61ad251efdc167c4ac028d4bf4e9563704b6cd4c7000a62e7363987bd8a7764262d6a08acb63

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2488	2940	rundll32.exe	33
PID 2940 wrote to memory of 2488	2940	rundll32.exe	33
PID 2940 wrote to memory of 2488	2940	rundll32.exe	33

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9259c384261f465a4fd9d3b39e440851f620fce9c5fcb983b6963a50371158cb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9259c384261f465a4fd9d3b39e440851f620fce9c5fcb983b6963a50371158cb.dll,#1
  2⤵
  PID:2488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads