1d56c886cd5c227e728cc8c6f66233d086f32bf7d16c9c7996c3b77169d7a944 | Triage

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 00:41

Sharing

Report Analysis Logs

General

Target

1d56c886cd5c227e728cc8c6f66233d086f32bf7d16c9c7996c3b77169d7a944.dll
Size

3KB
MD5

18c2284b72fc75fb8329cca3c058fa60
SHA1

9aa60406494ef2df875b5c2bcc3fe9d5fc35c21a
SHA256

1d56c886cd5c227e728cc8c6f66233d086f32bf7d16c9c7996c3b77169d7a944
SHA512

1efb3164021b50a5d63ddf88d03746a7766e7781a06f05c569302b4b76c31566a22fa2de2c7981e99531d98dac674c4306b398d0dec5773048b29d558efed604

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1944 wrote to memory of 3372	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 3372	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 3372	1944	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d56c886cd5c227e728cc8c6f66233d086f32bf7d16c9c7996c3b77169d7a944.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d56c886cd5c227e728cc8c6f66233d086f32bf7d16c9c7996c3b77169d7a944.dll,#1
2⤵
PID:3372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3372-132-0x0000000000000000-mapping.dmp

Download