4940588a4da38258fa93fea2f58a7120b9e179874bf9e30a3e2004b6fb98fb39 | Triage

Analysis

max time kernel
164s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 18:59

Sharing

Report Analysis Logs

General

Target

4940588a4da38258fa93fea2f58a7120b9e179874bf9e30a3e2004b6fb98fb39.dll
Size

4KB
MD5

13ebe128b73855d09af149149f73a743
SHA1

a3e2bd404795c88b94387ae12f4fe98174a4e7b1
SHA256

4940588a4da38258fa93fea2f58a7120b9e179874bf9e30a3e2004b6fb98fb39
SHA512

22bfc46dd0ddc40ec1ccfea22178ff8939ba21571396175d6c3ce4f47eef09d6190c004c66b0217abcba42ff6746e204274164938f166e034fe213101a325474

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 4848	1316	rundll32.exe	81
PID 1316 wrote to memory of 4848	1316	rundll32.exe	81
PID 1316 wrote to memory of 4848	1316	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4940588a4da38258fa93fea2f58a7120b9e179874bf9e30a3e2004b6fb98fb39.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4940588a4da38258fa93fea2f58a7120b9e179874bf9e30a3e2004b6fb98fb39.dll,#1
  2⤵
  PID:4848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads