edb9c0f515ce5952e438ceb51aaecf73000ef9a3a3bfb05c96339efda506ad3f | Triage

Analysis

max time kernel
249s
max time network
319s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 15:05

Sharing

Report Analysis Logs

General

Target

edb9c0f515ce5952e438ceb51aaecf73000ef9a3a3bfb05c96339efda506ad3f.dll
Size

3KB
MD5

c6b95dee8f3d3d51c19cf62d9d6d7ee9
SHA1

a1edc987a7b3fb5b0d150716e56961298905c475
SHA256

edb9c0f515ce5952e438ceb51aaecf73000ef9a3a3bfb05c96339efda506ad3f
SHA512

f030319c9be071339a294c5869a48b8200715e8eabc62bdab37d1b88471313d719c7d583062fd413789afe272854570da51f9ee4b4b8d56a80f0e358ce4049d9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 4072	1412	rundll32.exe	81
PID 1412 wrote to memory of 4072	1412	rundll32.exe	81
PID 1412 wrote to memory of 4072	1412	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\edb9c0f515ce5952e438ceb51aaecf73000ef9a3a3bfb05c96339efda506ad3f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\edb9c0f515ce5952e438ceb51aaecf73000ef9a3a3bfb05c96339efda506ad3f.dll,#1
  2⤵
  PID:4072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4072-132-0x0000000000000000-mapping.dmp

Download