84e7bdf1940ac00b63297f9d9cee613e32961fb5bfc00e08169552a1f9fb79e2 | Triage

Analysis

max time kernel
176s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 05:57

Sharing

Report Analysis Logs

General

Target

84e7bdf1940ac00b63297f9d9cee613e32961fb5bfc00e08169552a1f9fb79e2.dll
Size

3KB
MD5

78c0a79ec58d84d4ebaab2fae5218380
SHA1

765fb08d8ccb71bbed11cf06420836bce0c02750
SHA256

84e7bdf1940ac00b63297f9d9cee613e32961fb5bfc00e08169552a1f9fb79e2
SHA512

ecd8cc0c1d4a9b78a07db7fd8060155fd1ccb5a52e357d171f8875300e434e49cc6db2db1e2e274bee295ccc497fe4238920ca94d620f1d363f1cf97d7fdadae

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 5020	1168	rundll32.exe	82
PID 1168 wrote to memory of 5020	1168	rundll32.exe	82
PID 1168 wrote to memory of 5020	1168	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\84e7bdf1940ac00b63297f9d9cee613e32961fb5bfc00e08169552a1f9fb79e2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\84e7bdf1940ac00b63297f9d9cee613e32961fb5bfc00e08169552a1f9fb79e2.dll,#1
  2⤵
  PID:5020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads