65482134db12567336bd5779df5e9dcb71f5bebd45e4fc5483df3d3eb06d4b53 | Triage

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 21:17

Sharing

Report Analysis Logs

General

Target

65482134db12567336bd5779df5e9dcb71f5bebd45e4fc5483df3d3eb06d4b53.dll
Size

3KB
MD5

02f307417128691861a9cb480999c6a0
SHA1

93cfca6927f33bd42ecb80a364c160f14328230a
SHA256

65482134db12567336bd5779df5e9dcb71f5bebd45e4fc5483df3d3eb06d4b53
SHA512

d951c44775fac0b99b0f4e1f44f2dc77975127cb65ea92f84f540125125641f730fa6bc0762e452b8d00855d8e0b5f95d799c476b6f160045e70c221c8bf3203

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 4928	4980	rundll32.exe	81
PID 4980 wrote to memory of 4928	4980	rundll32.exe	81
PID 4980 wrote to memory of 4928	4980	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65482134db12567336bd5779df5e9dcb71f5bebd45e4fc5483df3d3eb06d4b53.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\65482134db12567336bd5779df5e9dcb71f5bebd45e4fc5483df3d3eb06d4b53.dll,#1
  2⤵
  PID:4928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads