ae5e6a0699475f5c2a1d8cb888a6e683303afce183648945ccadbb6850a835aa | Triage

Analysis

max time kernel
147s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 14:44

Sharing

Report Analysis Logs

General

Target

ae5e6a0699475f5c2a1d8cb888a6e683303afce183648945ccadbb6850a835aa.dll
Size

3KB
MD5

3233f17cbff2fb50ac0ba4dcaf089200
SHA1

9f3e641a8e1f02ac20fb9249a7e658d8d05c2f99
SHA256

ae5e6a0699475f5c2a1d8cb888a6e683303afce183648945ccadbb6850a835aa
SHA512

184bb1b5f7fdbbb9c78ba9be0e87d5d134318fb12172f3e5c9633df7b8d66dcaf8fe8dfb5ee6d69c5681fb6967f205d67b5a1a547cb68f07136596089aebb83e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 4028	1948	rundll32.exe	80
PID 1948 wrote to memory of 4028	1948	rundll32.exe	80
PID 1948 wrote to memory of 4028	1948	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae5e6a0699475f5c2a1d8cb888a6e683303afce183648945ccadbb6850a835aa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae5e6a0699475f5c2a1d8cb888a6e683303afce183648945ccadbb6850a835aa.dll,#1
  2⤵
  PID:4028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads