85733ecd16fb34ff7388bb0251395d852e9829291d28a69f72062ba2b30834d1 | Triage

Analysis

max time kernel
90s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 02:04

Sharing

Report Analysis Logs

General

Target

85733ecd16fb34ff7388bb0251395d852e9829291d28a69f72062ba2b30834d1.dll
Size

3KB
MD5

4cd20e187deadf99caff2d480f531c40
SHA1

9549877401e3f74517b7994958b9f4e61df919b3
SHA256

85733ecd16fb34ff7388bb0251395d852e9829291d28a69f72062ba2b30834d1
SHA512

96a4506f9835e0849d7445eadcaeaf68b729dfe52e823d028b637cdad716773f40b07e54eef25f31249a31313fc3b44a73c206462a6699eafc9c5b419dd2995a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 2228	4896	rundll32.exe	79
PID 4896 wrote to memory of 2228	4896	rundll32.exe	79
PID 4896 wrote to memory of 2228	4896	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\85733ecd16fb34ff7388bb0251395d852e9829291d28a69f72062ba2b30834d1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\85733ecd16fb34ff7388bb0251395d852e9829291d28a69f72062ba2b30834d1.dll,#1
  2⤵
  PID:2228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads