91691df9724620e2c005af0f2f07144de755ed9a5cb79e2c162bf9bfe0d099c2 | Triage

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 01:10

Sharing

Report Analysis Logs

General

Target

91691df9724620e2c005af0f2f07144de755ed9a5cb79e2c162bf9bfe0d099c2.dll
Size

3KB
MD5

260586af78f1e9af6b89409946746580
SHA1

e69221e4d4aba084fdb9d2a25391cb3b59ab3a68
SHA256

91691df9724620e2c005af0f2f07144de755ed9a5cb79e2c162bf9bfe0d099c2
SHA512

fb7d6f547e6cb0c94136a3ab35bdbf18b77232a3da0a19aecdb38d80194b5baed3048902930b74a9ffcd525c85b129693d1c74125ab00a423c232252dcc07f7d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 4344	616	rundll32.exe	64
PID 616 wrote to memory of 4344	616	rundll32.exe	64
PID 616 wrote to memory of 4344	616	rundll32.exe	64

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\91691df9724620e2c005af0f2f07144de755ed9a5cb79e2c162bf9bfe0d099c2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\91691df9724620e2c005af0f2f07144de755ed9a5cb79e2c162bf9bfe0d099c2.dll,#1
  2⤵
  PID:4344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads