64dd9583185f31ea7d6d56024349defccb452c8e23b1c02a96863423110053b0 | Triage

Analysis

max time kernel
157s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 15:53

Sharing

Report Analysis Logs

General

Target

64dd9583185f31ea7d6d56024349defccb452c8e23b1c02a96863423110053b0.dll
Size

4KB
MD5

6d47177492330e0585f9bc50ac890246
SHA1

0d5bd8275ad8d47fc6b577b402e03915bfae72fb
SHA256

64dd9583185f31ea7d6d56024349defccb452c8e23b1c02a96863423110053b0
SHA512

c111c4beefd9af94115dffb9f5dd7031d0477eb056030f28f973febe443107a91f567a3b31de5d1fabfe9a11c703ccf871f86170390c5971fe77bf0a91a91db4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 3144	4896	rundll32.exe	51
PID 4896 wrote to memory of 3144	4896	rundll32.exe	51
PID 4896 wrote to memory of 3144	4896	rundll32.exe	51

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64dd9583185f31ea7d6d56024349defccb452c8e23b1c02a96863423110053b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64dd9583185f31ea7d6d56024349defccb452c8e23b1c02a96863423110053b0.dll,#1
  2⤵
  PID:3144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3144-132-0x0000000000000000-mapping.dmp

Download