ce6f3960750e01af43b6a6da80a4e25e36333fe71a66ec2ac4ab00d54a58274c | Triage

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2022 05:25

Sharing

Report Analysis Logs

General

Target

ce6f3960750e01af43b6a6da80a4e25e36333fe71a66ec2ac4ab00d54a58274c.dll
Size

3KB
MD5

4363e78f123a83236908f803714b7472
SHA1

a38f3d0007855a6b2ef07d070bd3b0de4ad7bb44
SHA256

ce6f3960750e01af43b6a6da80a4e25e36333fe71a66ec2ac4ab00d54a58274c
SHA512

961727865293d9baa68a5e8fdc174c0e69ed21886d5a9117238d8fec2cfb765d84982c9ab7bf768ef4759d0b52e90f61e06637edf87cfe37b7572d99ce45975f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2204	1044	rundll32.exe	83
PID 1044 wrote to memory of 2204	1044	rundll32.exe	83
PID 1044 wrote to memory of 2204	1044	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce6f3960750e01af43b6a6da80a4e25e36333fe71a66ec2ac4ab00d54a58274c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce6f3960750e01af43b6a6da80a4e25e36333fe71a66ec2ac4ab00d54a58274c.dll,#1
  2⤵
  PID:2204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads