012098468caa36b731141ce41a8eac7a80da3fcbbebdf7f1e3040a1ddd22a183 | Triage

Analysis

max time kernel
138s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 14:51

Sharing

Report Analysis Logs

General

Target

012098468caa36b731141ce41a8eac7a80da3fcbbebdf7f1e3040a1ddd22a183.dll
Size

3KB
MD5

968856856f0c10b25912f2166345d848
SHA1

845eb648c16fe6a471fa96bb392d54cd90a7c453
SHA256

012098468caa36b731141ce41a8eac7a80da3fcbbebdf7f1e3040a1ddd22a183
SHA512

e8a2c9e6a2b9018a5574d7c982297f7f6f3653f6a684a511d728c579f9e4885dc2e6e712c295fc19f926105b8349c33eb723e702fa871145e5a5ef36b14b64ab

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4640	4136	rundll32.exe	82
PID 4136 wrote to memory of 4640	4136	rundll32.exe	82
PID 4136 wrote to memory of 4640	4136	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\012098468caa36b731141ce41a8eac7a80da3fcbbebdf7f1e3040a1ddd22a183.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\012098468caa36b731141ce41a8eac7a80da3fcbbebdf7f1e3040a1ddd22a183.dll,#1
  2⤵
  PID:4640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads