39e9d1cd9e10c03c1d7f3c8d32b6374eb7f9aa4661e7c6199f332e1687394f1f | Triage

Analysis

max time kernel
184s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 05:21

Sharing

Report Analysis Logs

General

Target

39e9d1cd9e10c03c1d7f3c8d32b6374eb7f9aa4661e7c6199f332e1687394f1f.dll
Size

3KB
MD5

622b3fe08a7805e807b2811a9e9ca6e0
SHA1

974502b93eadfd2ccab98003f785d41dee3e0ac9
SHA256

39e9d1cd9e10c03c1d7f3c8d32b6374eb7f9aa4661e7c6199f332e1687394f1f
SHA512

d03c34ec27dc7ef1a6d6a2fb35aae6a66f073bf332a0e602e6e211cc7983f39363e4c95d3627672c17b6e0aab59c93ba4f0f19a9c6e219ca36fe2f86805c1a35

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 4876	4368	rundll32.exe	83
PID 4368 wrote to memory of 4876	4368	rundll32.exe	83
PID 4368 wrote to memory of 4876	4368	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39e9d1cd9e10c03c1d7f3c8d32b6374eb7f9aa4661e7c6199f332e1687394f1f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\39e9d1cd9e10c03c1d7f3c8d32b6374eb7f9aa4661e7c6199f332e1687394f1f.dll,#1
  2⤵
  PID:4876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4876-132-0x0000000000000000-mapping.dmp

Download