a9f34258d1bd92b80d7aa40b7b6b931caacbbdfe4f3dc1330b4f42fae684f425 | Triage

Analysis

max time kernel
101s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 16:45

Sharing

Report Analysis Logs

General

Target

a9f34258d1bd92b80d7aa40b7b6b931caacbbdfe4f3dc1330b4f42fae684f425.dll
Size

3KB
MD5

6aec641003ad58b383986a38e2196483
SHA1

f2833dc5de86eb5a7c1455cf39ffeabf111390f7
SHA256

a9f34258d1bd92b80d7aa40b7b6b931caacbbdfe4f3dc1330b4f42fae684f425
SHA512

45b9baacb56ae10dedfa7a04872ebc778fb1a5031778de16fdc830c6aa98c60ff738a81405536b0639c3ffd929c82e104034728550f1572ac6e57f4e64777bd2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 4336	5080	rundll32.exe	84
PID 5080 wrote to memory of 4336	5080	rundll32.exe	84
PID 5080 wrote to memory of 4336	5080	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9f34258d1bd92b80d7aa40b7b6b931caacbbdfe4f3dc1330b4f42fae684f425.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9f34258d1bd92b80d7aa40b7b6b931caacbbdfe4f3dc1330b4f42fae684f425.dll,#1
  2⤵
  PID:4336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads