8932e3037069929459831a4d5f6ec8c930be911b237ce882096ca48ecb3ffc78 | Triage

Analysis

max time kernel
75s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 18:00

Sharing

Report Analysis Logs

General

Target

8932e3037069929459831a4d5f6ec8c930be911b237ce882096ca48ecb3ffc78.dll
Size

3KB
MD5

82a4ae1380e5d88ae7b5b6dd23d8bce0
SHA1

e107f9f6efcce33ef3d3e0c83256eabbc4376d08
SHA256

8932e3037069929459831a4d5f6ec8c930be911b237ce882096ca48ecb3ffc78
SHA512

017f2c837a480f8d4e3a8774861aa5676af5520a5ff2cc03ac8c98275b2da61aa6005ce1ce54614c60dca96d4843727d30fbb316b954064efe7dbf80e1e4e76e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 2376	3444	rundll32.exe	80
PID 3444 wrote to memory of 2376	3444	rundll32.exe	80
PID 3444 wrote to memory of 2376	3444	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8932e3037069929459831a4d5f6ec8c930be911b237ce882096ca48ecb3ffc78.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8932e3037069929459831a4d5f6ec8c930be911b237ce882096ca48ecb3ffc78.dll,#1
  2⤵
  PID:2376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads