72fc7c7b70f5c64abeabb435735f991556f912f6ad82168034d813c3ca9bf658 | Triage

Analysis

max time kernel
189s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 00:49

Sharing

Report Analysis Logs

General

Target

72fc7c7b70f5c64abeabb435735f991556f912f6ad82168034d813c3ca9bf658.dll
Size

3KB
MD5

45454f076705acff02a6c6f326579237
SHA1

1fe25b500161749bfc0fefc85c4f8a1acdf04df1
SHA256

72fc7c7b70f5c64abeabb435735f991556f912f6ad82168034d813c3ca9bf658
SHA512

997ef8914439a1287d6db1d087fbd4a8a0f8b20e9cfd0a23e04b330361f5365130d3f34f532cda770dae1cccabdd533933559605cb25a5f019a99331eae93482

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 2100	4388	rundll32.exe	82
PID 4388 wrote to memory of 2100	4388	rundll32.exe	82
PID 4388 wrote to memory of 2100	4388	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72fc7c7b70f5c64abeabb435735f991556f912f6ad82168034d813c3ca9bf658.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\72fc7c7b70f5c64abeabb435735f991556f912f6ad82168034d813c3ca9bf658.dll,#1
  2⤵
  PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads