0f8560cc3d3fed15dbe0c4eeadcc57ded3c07ac5778457af7543e7b0d471bb8b | Triage

Analysis

max time kernel
112s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:58

Sharing

Report Analysis Logs

General

Target

0f8560cc3d3fed15dbe0c4eeadcc57ded3c07ac5778457af7543e7b0d471bb8b.dll
Size

3KB
MD5

455a8927f612ba7c36c52b0b0843cbb0
SHA1

85ffef5196d800522c2e1fa6826df56e0c746106
SHA256

0f8560cc3d3fed15dbe0c4eeadcc57ded3c07ac5778457af7543e7b0d471bb8b
SHA512

31ba684649d7cf09624384031e0c60dc8354458ad02461f1344297a100f91272c082a425f8007a06e004066e6578060dc6b83ba1b373e3bc1d0a2114cf4fc7dd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5080 wrote to memory of 928	5080	rundll32.exe	rundll32.exe
PID 5080 wrote to memory of 928	5080	rundll32.exe	rundll32.exe
PID 5080 wrote to memory of 928	5080	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f8560cc3d3fed15dbe0c4eeadcc57ded3c07ac5778457af7543e7b0d471bb8b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5080

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f8560cc3d3fed15dbe0c4eeadcc57ded3c07ac5778457af7543e7b0d471bb8b.dll,#1
2⤵
PID:928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/928-132-0x0000000000000000-mapping.dmp

Download