c93628e28b3f6c7e30d0639207a6d15c07088c813a2631594c03765b47d4d43d | Triage

Analysis

max time kernel
172s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 12:56

Sharing

Report Analysis Logs

General

Target

c93628e28b3f6c7e30d0639207a6d15c07088c813a2631594c03765b47d4d43d.dll
Size

3KB
MD5

0f0fef059fc430a4efca5db266bae0f2
SHA1

4323e0e34eb3b180e9a21b9b8e134ce563a575fa
SHA256

c93628e28b3f6c7e30d0639207a6d15c07088c813a2631594c03765b47d4d43d
SHA512

4bd39e5edacdf12e3dc6cebf08a8935b84ef5f68e8d2ce58636605ad87fa1b7ce83888d9b1b7e9668d5851d6b07e99f26be6db3fb4a2fe6d84c66b6d6d42e58e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 2288	4356	rundll32.exe	80
PID 4356 wrote to memory of 2288	4356	rundll32.exe	80
PID 4356 wrote to memory of 2288	4356	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c93628e28b3f6c7e30d0639207a6d15c07088c813a2631594c03765b47d4d43d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c93628e28b3f6c7e30d0639207a6d15c07088c813a2631594c03765b47d4d43d.dll,#1
  2⤵
  PID:2288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads