0d7a42c2f9475cdcc4bbfd49da9031789090fb4341a3985056e1c67e9705a755 | Triage

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:10

Sharing

Report Analysis Logs

General

Target

0d7a42c2f9475cdcc4bbfd49da9031789090fb4341a3985056e1c67e9705a755.dll
Size

3KB
MD5

067c79384ecd49c9c730b290ff957f8f
SHA1

e112672b3dae3292a1f010af81cbd27ec4217929
SHA256

0d7a42c2f9475cdcc4bbfd49da9031789090fb4341a3985056e1c67e9705a755
SHA512

f16b1796f8f87a2ff189043a844cdedf0d2853c6020c6a8650bddb7ad8fa540c82b7d1590b4ed64401e6d7d87a4361efc93cb2895ac686ca5920c82fa092125c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4140 wrote to memory of 2864	4140	rundll32.exe	rundll32.exe
PID 4140 wrote to memory of 2864	4140	rundll32.exe	rundll32.exe
PID 4140 wrote to memory of 2864	4140	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d7a42c2f9475cdcc4bbfd49da9031789090fb4341a3985056e1c67e9705a755.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4140

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d7a42c2f9475cdcc4bbfd49da9031789090fb4341a3985056e1c67e9705a755.dll,#1
2⤵
PID:2864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2864-132-0x0000000000000000-mapping.dmp

Download