81bfaa6a5b3094e93341d297fa464148bb64336b08297c5f6e3bef342e55f5d7 | Triage™

Analysis

max time kernel
179s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 05:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
81bfaa6a5b3094e93341d297fa464148bb64336b08297c5f6e3bef342e55f5d7.dll
Size 4KB
Sample221129-ggamysba74
SHA256 81bfaa6a5b3094e93341d297fa464148bb64336b08297c5f6e3bef342e55f5d7
MD5 a903c67e954f74d16d10a3bf7cba35f0
SHA1 7b617db24c3e65002685d46f63bf2ae3423d258f
SHA512 7129a1ecf820f2b722e445458d8d0cd97cba0253dc1f59741400e17d0fc0e769921d6cd5bd64bf6a8919dc1b82fa37a9fcff0d2a5820a3a3022d1b7a18a6c649
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 2392	4708	rundll32.exe	83
PID 4708 wrote to memory of 2392	4708	rundll32.exe	83
PID 4708 wrote to memory of 2392	4708	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\81bfaa6a5b3094e93341d297fa464148bb64336b08297c5f6e3bef342e55f5d7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\81bfaa6a5b3094e93341d297fa464148bb64336b08297c5f6e3bef342e55f5d7.dll,#1
  2⤵
  PID:2392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads