fb8c0ff5fcc749ca4963a64b9b37e2f80c8fda8fc2273b7e483e33b1939a9aad | Triage

Analysis

max time kernel
188s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 05:38

Sharing

Report Analysis Logs

General

Target

fb8c0ff5fcc749ca4963a64b9b37e2f80c8fda8fc2273b7e483e33b1939a9aad.dll
Size

4KB
MD5

a18b2926770d03aac4bbdd57e300ed20
SHA1

327d3324f8487b20447ba79db7d8a1c32a2ec86e
SHA256

fb8c0ff5fcc749ca4963a64b9b37e2f80c8fda8fc2273b7e483e33b1939a9aad
SHA512

3d50f99d896fcc965eff19542edfc2bdab4be237222b03aef48c4868f932684abc7cc5daaeb24260b7b73b7576625bc449c77674242899fd065326e311fe9cbd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 3432	672	rundll32.exe	82
PID 672 wrote to memory of 3432	672	rundll32.exe	82
PID 672 wrote to memory of 3432	672	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb8c0ff5fcc749ca4963a64b9b37e2f80c8fda8fc2273b7e483e33b1939a9aad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb8c0ff5fcc749ca4963a64b9b37e2f80c8fda8fc2273b7e483e33b1939a9aad.dll,#1
  2⤵
  PID:3432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads