876e43860ddb2de343ac8d139f0b282cb20e2f40d36b44f660856c511467ffb7 | Triage™

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 21:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
876e43860ddb2de343ac8d139f0b282cb20e2f40d36b44f660856c511467ffb7.dll
Size 3KB
Sample221003-1k388aggfm
SHA256 876e43860ddb2de343ac8d139f0b282cb20e2f40d36b44f660856c511467ffb7
MD5 5d80809487a5eca7424b652e007b9eb0
SHA1 d4000e1bfa8453c61111c9ff820167f05f207655
SHA512 c4416a27cce89bcd66871fa2dce38e8a25571dc14bab21c949bf793fbf2966a4d574a0f27f53aa55a37a766bfe035aacd35807de5a99f841e464d72b11addcad
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 3708	2056	rundll32.exe	58
PID 2056 wrote to memory of 3708	2056	rundll32.exe	58
PID 2056 wrote to memory of 3708	2056	rundll32.exe	58

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\876e43860ddb2de343ac8d139f0b282cb20e2f40d36b44f660856c511467ffb7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\876e43860ddb2de343ac8d139f0b282cb20e2f40d36b44f660856c511467ffb7.dll,#1
  2⤵
  PID:3708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads