b82d96c4b3da6f05da7f9017351e10326732303f1c55a49f7b96e7e9d3b112b9 | Triage

Analysis

max time kernel
96s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 07:01

Sharing

Report Analysis Logs

General

Target

b82d96c4b3da6f05da7f9017351e10326732303f1c55a49f7b96e7e9d3b112b9.dll
Size

3KB
MD5

673429433a33a35498179709c668ea84
SHA1

8244cb7d13bbbb5c9fef9b55521ca683f0361b51
SHA256

b82d96c4b3da6f05da7f9017351e10326732303f1c55a49f7b96e7e9d3b112b9
SHA512

9e04732545f28a198e8c1cc962b658d5da748c8fe894d8df88fa92cd4d8765f9618ae530ebae8adde330bf95809eb48d8c8f7e5e3f388b7268be69bb43084d40

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2288	2040	rundll32.exe	78
PID 2040 wrote to memory of 2288	2040	rundll32.exe	78
PID 2040 wrote to memory of 2288	2040	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b82d96c4b3da6f05da7f9017351e10326732303f1c55a49f7b96e7e9d3b112b9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b82d96c4b3da6f05da7f9017351e10326732303f1c55a49f7b96e7e9d3b112b9.dll,#1
  2⤵
  PID:2288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads