a4bff91e84ce550c2ca9031c09a60ba8576bc2a7468b7ebd1730a1c6ec76e960 | Triage

Analysis

max time kernel
135s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 05:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a4bff91e84ce550c2ca9031c09a60ba8576bc2a7468b7ebd1730a1c6ec76e960.dll
Size

3KB
MD5

a30799ee3e112d07038607ce80a94ee0
SHA1

77c9fe6142d588203ff9aa3ce2f1985f592291ca
SHA256

a4bff91e84ce550c2ca9031c09a60ba8576bc2a7468b7ebd1730a1c6ec76e960
SHA512

5e8cc77c6778c97a20098e8e28b40b610557c01981c3ba62e96e01a8a2d58c16258ee4d50b7f53344b833ac0615097e89b475ec778ecf5d1ecce5ab622f0c7c6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 1344	1828	rundll32.exe	61
PID 1828 wrote to memory of 1344	1828	rundll32.exe	61
PID 1828 wrote to memory of 1344	1828	rundll32.exe	61

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4bff91e84ce550c2ca9031c09a60ba8576bc2a7468b7ebd1730a1c6ec76e960.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4bff91e84ce550c2ca9031c09a60ba8576bc2a7468b7ebd1730a1c6ec76e960.dll,#1
  2⤵
  PID:1344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads