e0a3ec3471b305c23e4e68b92a053f51ee39bd107508a9b053b8af5d8098dabb | Triage

Analysis

max time kernel
138s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 01:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e0a3ec3471b305c23e4e68b92a053f51ee39bd107508a9b053b8af5d8098dabb.dll
Size

3KB
MD5

11e3ab80ec2d47d4b610a1fe22385c20
SHA1

1c16dafcd403ab421763c7e7b03de6607e7df31c
SHA256

e0a3ec3471b305c23e4e68b92a053f51ee39bd107508a9b053b8af5d8098dabb
SHA512

4d244605c440a34af11c1e4a86b6ba7b1fed55356bf8e0775f1f1aa9f8a61a145efd8f7f7b331ffc049fda9a0d153e462e121b2ef1fdd23e361209a8f53f2637

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 2128	4836	rundll32.exe	81
PID 4836 wrote to memory of 2128	4836	rundll32.exe	81
PID 4836 wrote to memory of 2128	4836	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0a3ec3471b305c23e4e68b92a053f51ee39bd107508a9b053b8af5d8098dabb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0a3ec3471b305c23e4e68b92a053f51ee39bd107508a9b053b8af5d8098dabb.dll,#1
  2⤵
  PID:2128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads