04e5878a81e9787297835a9a1f1df0b18bc8998620beffb14b24fe2476af329c | Triage

Analysis

max time kernel
92s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 14:48 UTC

Sharing

Report Analysis Logs

General

Target

04e5878a81e9787297835a9a1f1df0b18bc8998620beffb14b24fe2476af329c.dll
Size

3KB
MD5

a064385203b8798db412a4c1d0298990
SHA1

ea924d414220686145834ff18efb24e2e76bdbd3
SHA256

04e5878a81e9787297835a9a1f1df0b18bc8998620beffb14b24fe2476af329c
SHA512

e963eaea8a4b3c211a4625880d989f5a2c845b33457d716a275adb61c336150b757cc6191ce2d339fa59dc22ff37c13ec8f8c14b77bc7f5104578ec36b9e923e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 4940	3520	rundll32.exe	29
PID 3520 wrote to memory of 4940	3520	rundll32.exe	29
PID 3520 wrote to memory of 4940	3520	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04e5878a81e9787297835a9a1f1df0b18bc8998620beffb14b24fe2476af329c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\04e5878a81e9787297835a9a1f1df0b18bc8998620beffb14b24fe2476af329c.dll,#1
  2⤵
  PID:4940

Network

No results found

52.109.8.86:443

40 B
1
93.184.220.29:80

46 B
40 B
1
1
93.184.221.240:80

322 B
7
52.182.143.210:443

322 B
7
93.184.220.29:80

322 B
7
93.184.220.29:80

322 B
7
209.197.3.8:80

46 B
40 B
1
1

No results found

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads