db4ef33c1848b7796e670a4694c250aca5cefdd3cb7ed7e46e23d3c0f329c5ba | Triage

Analysis

max time kernel
92s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 21:10

Sharing

Report Analysis Logs

General

Target

db4ef33c1848b7796e670a4694c250aca5cefdd3cb7ed7e46e23d3c0f329c5ba.dll
Size

3KB
MD5

4a39106c8a285514f80a53fc467b5e60
SHA1

169c7dfef1815a078c1b73649a3bcd21cef276cb
SHA256

db4ef33c1848b7796e670a4694c250aca5cefdd3cb7ed7e46e23d3c0f329c5ba
SHA512

a562715377e20a6ff629c275b5850bcb59cf147ff2d7aa0296dbc71f8b839dbf8af7b2fcdd6fa7d75f251c36af48afdcf183a46769d34cca8be1f676ae6cb518

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 4952	1696	rundll32.exe	80
PID 1696 wrote to memory of 4952	1696	rundll32.exe	80
PID 1696 wrote to memory of 4952	1696	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\db4ef33c1848b7796e670a4694c250aca5cefdd3cb7ed7e46e23d3c0f329c5ba.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\db4ef33c1848b7796e670a4694c250aca5cefdd3cb7ed7e46e23d3c0f329c5ba.dll,#1
  2⤵
  PID:4952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads