c2a5fd9f67f7416c749f50727dec3c0ccf7a7a2de845ee5552f3868b383c9232 | Triage

Analysis

max time kernel
107s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 14:49

Sharing

Report Analysis Logs

General

Target

c2a5fd9f67f7416c749f50727dec3c0ccf7a7a2de845ee5552f3868b383c9232.dll
Size

3KB
MD5

a02ed269b3b0c8ef4d725e2925be739f
SHA1

db1de0d7fece42e0e153e3c3a65baefad7e5b192
SHA256

c2a5fd9f67f7416c749f50727dec3c0ccf7a7a2de845ee5552f3868b383c9232
SHA512

663d998f105e741876db6424a2fec56fdf9bd7ef847a29456ddd7c5fcabfb8cfc87ba021161706dc317c4389642ded36e0b24c7e6a0a52662f29826fff2fc264

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 4952	4368	rundll32.exe	81
PID 4368 wrote to memory of 4952	4368	rundll32.exe	81
PID 4368 wrote to memory of 4952	4368	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c2a5fd9f67f7416c749f50727dec3c0ccf7a7a2de845ee5552f3868b383c9232.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c2a5fd9f67f7416c749f50727dec3c0ccf7a7a2de845ee5552f3868b383c9232.dll,#1
  2⤵
  PID:4952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads