0db2b74bfe15b1168b114c729531037c52b343a268aabcf17794cc1010c1a798 | Triage

Analysis

max time kernel
133s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2022 06:23

Sharing

Report Analysis Logs

General

Target

0db2b74bfe15b1168b114c729531037c52b343a268aabcf17794cc1010c1a798.dll
Size

3KB
MD5

1ca32213473ec85c887d08ff1b440f6c
SHA1

12b8b6275d80fb09dbd792c2ed5056edf3705c80
SHA256

0db2b74bfe15b1168b114c729531037c52b343a268aabcf17794cc1010c1a798
SHA512

ddecf915c1b66bdb73711994e1e9d3545ecd8e8e2a1c7f862914dacf8c3c7cea38219d65f63bac000d330f56ee06daaf129b2efadc163a893a326b95fe8f7d76

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 5084	1760	rundll32.exe	82
PID 1760 wrote to memory of 5084	1760	rundll32.exe	82
PID 1760 wrote to memory of 5084	1760	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0db2b74bfe15b1168b114c729531037c52b343a268aabcf17794cc1010c1a798.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0db2b74bfe15b1168b114c729531037c52b343a268aabcf17794cc1010c1a798.dll,#1
  2⤵
  PID:5084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads