25f169993dce541f385811ead7b8f064470068710baa607126ba64d08da44d92 | Triage

Analysis

max time kernel
139s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2022 05:27

Sharing

Report Analysis Logs

General

Target

25f169993dce541f385811ead7b8f064470068710baa607126ba64d08da44d92.dll
Size

3KB
MD5

92f63f940bdbfedfd99c19d58689d2b0
SHA1

3f5dd71b8759351a45b4f32b2a69e947d65e54a3
SHA256

25f169993dce541f385811ead7b8f064470068710baa607126ba64d08da44d92
SHA512

8bfc7c6455975c9773d9151be48bc9d0dac82419ca808d4dc32474727152c0d95642cc37b7e477ebb0b4b9f2ffeb756b65b32f27fbc9adcb71a78069bf909622

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1124	2240	rundll32.exe	81
PID 2240 wrote to memory of 1124	2240	rundll32.exe	81
PID 2240 wrote to memory of 1124	2240	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25f169993dce541f385811ead7b8f064470068710baa607126ba64d08da44d92.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\25f169993dce541f385811ead7b8f064470068710baa607126ba64d08da44d92.dll,#1
  2⤵
  PID:1124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1124-132-0x0000000000000000-mapping.dmp

Download