6e55dda809856cb2500d0513ea7bf3ff87466169c62786050cb8976e4734aeb8 | Triage

Analysis

max time kernel
154s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 05:17

Sharing

Report Analysis Logs

General

Target

6e55dda809856cb2500d0513ea7bf3ff87466169c62786050cb8976e4734aeb8.dll
Size

3KB
MD5

49859f750b4c3a29ff4513d9bea16c80
SHA1

c26d8d62fdf23cc4a484b44744a22437175958d9
SHA256

6e55dda809856cb2500d0513ea7bf3ff87466169c62786050cb8976e4734aeb8
SHA512

efcf5b14f997b5bf6ba1d160ff3260af3ed60abfe05e1fff8834da925a6627d333f663afdf2b14f665672e742a281bcb902aefb42af35a07989d69e2f2d29d1e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 4676	2836	rundll32.exe	79
PID 2836 wrote to memory of 4676	2836	rundll32.exe	79
PID 2836 wrote to memory of 4676	2836	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6e55dda809856cb2500d0513ea7bf3ff87466169c62786050cb8976e4734aeb8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6e55dda809856cb2500d0513ea7bf3ff87466169c62786050cb8976e4734aeb8.dll,#1
  2⤵
  PID:4676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads