a0ab1b3896f9698faf31bd835cab6992b1155d49afd872ff226bd44802328eb9 | Triage

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 00:51

Sharing

Report Analysis Logs

General

Target

a0ab1b3896f9698faf31bd835cab6992b1155d49afd872ff226bd44802328eb9.dll
Size

4KB
MD5

35c80316e8a05fd16d6a05406176c5b2
SHA1

f21fd0491a666ae80c3918e1931347a1e215171a
SHA256

a0ab1b3896f9698faf31bd835cab6992b1155d49afd872ff226bd44802328eb9
SHA512

54e9ae2ac7c9f302f44dcd6c47c1d3c4bd8b93f37c44ceb799ea18190591eedaad7313a0c3fe663f14b959a116e0b5f6f0378f383189e449d982fdd6224f1e4f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2232	1368	rundll32.exe	80
PID 1368 wrote to memory of 2232	1368	rundll32.exe	80
PID 1368 wrote to memory of 2232	1368	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0ab1b3896f9698faf31bd835cab6992b1155d49afd872ff226bd44802328eb9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0ab1b3896f9698faf31bd835cab6992b1155d49afd872ff226bd44802328eb9.dll,#1
  2⤵
  PID:2232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads