0446b5472eb186e37feedf0ce3f0b778741dee47c1a85ab1282a5b99b56961f9 | Triage

Analysis

max time kernel
149s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 21:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0446b5472eb186e37feedf0ce3f0b778741dee47c1a85ab1282a5b99b56961f9.dll
Size

3KB
MD5

0dd22f8600252b6b796c52c95e13c510
SHA1

c4a0d8728988ea72347e019b1a21fc62831fa136
SHA256

0446b5472eb186e37feedf0ce3f0b778741dee47c1a85ab1282a5b99b56961f9
SHA512

00f3d72c589f1aca76ac9afc950725650cfac9b6f34e7afdc7da5f076a48dc82962bffc4305074731911eafe3f7a1e8727e9c6fb33647bfd1dc4576a84d31315

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 3312	4616	rundll32.exe	79
PID 4616 wrote to memory of 3312	4616	rundll32.exe	79
PID 4616 wrote to memory of 3312	4616	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0446b5472eb186e37feedf0ce3f0b778741dee47c1a85ab1282a5b99b56961f9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0446b5472eb186e37feedf0ce3f0b778741dee47c1a85ab1282a5b99b56961f9.dll,#1
  2⤵
  PID:3312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads