769abe4cdc120b1ef500793a5743c9ea0fbee5ec765a05d424d4e79b9af410ad | Triage

Analysis

max time kernel
141s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2022 00:49

Sharing

Report Analysis Logs

General

Target

769abe4cdc120b1ef500793a5743c9ea0fbee5ec765a05d424d4e79b9af410ad.dll
Size

4KB
MD5

5227cb2e64da189a7e10a3b2183c9ecd
SHA1

c50d5a99ded10b506076655b1761d5b8e01ae488
SHA256

769abe4cdc120b1ef500793a5743c9ea0fbee5ec765a05d424d4e79b9af410ad
SHA512

cd0146ae31fce3eb25ebd05bed6201f975c0f071b222445094ebadca186a5ffc3f40dc8418d7281ccd154a299bd10d3539152cadec24f2a6fe3540cef9102ea0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 2408	580	rundll32.exe	83
PID 580 wrote to memory of 2408	580	rundll32.exe	83
PID 580 wrote to memory of 2408	580	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\769abe4cdc120b1ef500793a5743c9ea0fbee5ec765a05d424d4e79b9af410ad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\769abe4cdc120b1ef500793a5743c9ea0fbee5ec765a05d424d4e79b9af410ad.dll,#1
  2⤵
  PID:2408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2408-132-0x0000000000000000-mapping.dmp

Download