d68804eab02722879320883af13fd2fbaab9e5703e4e1e746a21616bc4c8f771 | Triage

Analysis

max time kernel
135s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 15:57

Sharing

Report Analysis Logs

General

Target

d68804eab02722879320883af13fd2fbaab9e5703e4e1e746a21616bc4c8f771.dll
Size

3KB
MD5

00d8751cee93b20711fd6c6eeb155438
SHA1

138c5f4cd61c57bea042a24d254aaed49901334d
SHA256

d68804eab02722879320883af13fd2fbaab9e5703e4e1e746a21616bc4c8f771
SHA512

6ed1d7e18ec1aa416e57b3e5654db1e6dbf1de5399889f0b9e9d2e52102543034d95b057b1c741f90b6ea0053957ef09ab5b02f2c24bda272186fee16155220f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4428	4772	rundll32.exe	80
PID 4772 wrote to memory of 4428	4772	rundll32.exe	80
PID 4772 wrote to memory of 4428	4772	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d68804eab02722879320883af13fd2fbaab9e5703e4e1e746a21616bc4c8f771.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d68804eab02722879320883af13fd2fbaab9e5703e4e1e746a21616bc4c8f771.dll,#1
  2⤵
  PID:4428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads