f3ec18c2a1e5fee10d4c13860e0d4838ee88253051b5ec1fd2943af93e37015c | Triage

Analysis

max time kernel
66s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 14:43

Sharing

Report Analysis Logs

General

Target

f3ec18c2a1e5fee10d4c13860e0d4838ee88253051b5ec1fd2943af93e37015c.dll
Size

3KB
MD5

1e6972b3294ce52f64d858544da73a70
SHA1

e07228ac6744802bb4bff3daed26b798c27d7075
SHA256

f3ec18c2a1e5fee10d4c13860e0d4838ee88253051b5ec1fd2943af93e37015c
SHA512

0d28f7a6aa737d0eff00f5b7479bfde45974fab15fcbece2caed64143061ff1171460affbc3037c8474a88f6b56bcf5d556863ce1f9ca8055c9b1094b315720e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 4808	1092	rundll32.exe	80
PID 1092 wrote to memory of 4808	1092	rundll32.exe	80
PID 1092 wrote to memory of 4808	1092	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3ec18c2a1e5fee10d4c13860e0d4838ee88253051b5ec1fd2943af93e37015c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3ec18c2a1e5fee10d4c13860e0d4838ee88253051b5ec1fd2943af93e37015c.dll,#1
  2⤵
  PID:4808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads