9935cf216a37bd56df3ec2fc13a2a2c9fd0836b1a856f061b25c8a34db97a15f | Triage

Analysis

max time kernel
282s
max time network
330s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 05:44

Sharing

Report Analysis Logs

General

Target

9935cf216a37bd56df3ec2fc13a2a2c9fd0836b1a856f061b25c8a34db97a15f.dll
Size

4KB
MD5

edb6d1285405c3865785fb706416da10
SHA1

081d0d975aa0877423438592ab262826f38042b7
SHA256

9935cf216a37bd56df3ec2fc13a2a2c9fd0836b1a856f061b25c8a34db97a15f
SHA512

009d33783dd05138755555655630d64c251b43c96fa02d058f5fd77057fc5e6513151f68309001660e6eadce79a2722ad246de52ea25d1b303cf928d0b13bd95

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 3172	4068	rundll32.exe	80
PID 4068 wrote to memory of 3172	4068	rundll32.exe	80
PID 4068 wrote to memory of 3172	4068	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9935cf216a37bd56df3ec2fc13a2a2c9fd0836b1a856f061b25c8a34db97a15f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9935cf216a37bd56df3ec2fc13a2a2c9fd0836b1a856f061b25c8a34db97a15f.dll,#1
  2⤵
  PID:3172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads