de981ba7b91ac39e6902c39427f67083be389362e3204f25aa72347fcb230787 | Triage

Analysis

max time kernel
163s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 00:40

Sharing

Report Analysis Logs

General

Target

de981ba7b91ac39e6902c39427f67083be389362e3204f25aa72347fcb230787.dll
Size

3KB
MD5

3511b2eb2e5419dfe70fcac9ddefdd40
SHA1

09e3826fc6916bfeba73f3dec2b1cf2da28cb86e
SHA256

de981ba7b91ac39e6902c39427f67083be389362e3204f25aa72347fcb230787
SHA512

fa3cfc4e0e40be8201f541f4bd484415a7cd9af8d6928e80755282ba7019636097b803b30c26aee1b67f4de527b6e061fa484a1c6f1bcfa07df17e717a1227a6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 2132	4632	rundll32.exe	79
PID 4632 wrote to memory of 2132	4632	rundll32.exe	79
PID 4632 wrote to memory of 2132	4632	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de981ba7b91ac39e6902c39427f67083be389362e3204f25aa72347fcb230787.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de981ba7b91ac39e6902c39427f67083be389362e3204f25aa72347fcb230787.dll,#1
  2⤵
  PID:2132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads