d42f1722fd626c37aa6713e0fa15c40f335a5d3b36be9eea94f2e9b5d2b02ebf | Triage

Analysis

max time kernel
163s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 15:06

Sharing

Report Analysis Logs

General

Target

d42f1722fd626c37aa6713e0fa15c40f335a5d3b36be9eea94f2e9b5d2b02ebf.dll
Size

3KB
MD5

ca4668a69910ac8ec4ccf59912f11329
SHA1

2be31b39f6915a97b64ca395e3b954f7fca5c338
SHA256

d42f1722fd626c37aa6713e0fa15c40f335a5d3b36be9eea94f2e9b5d2b02ebf
SHA512

9fd4ab3ed4120f5f68e23c135adf7b7066314ba6298ceb87b6fe1f45cc99fdedaa9182a59096a9dafc53abd074194e3edcac9aff59e9e2fa64585240181211e8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 4980	2020	rundll32.exe	81
PID 2020 wrote to memory of 4980	2020	rundll32.exe	81
PID 2020 wrote to memory of 4980	2020	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d42f1722fd626c37aa6713e0fa15c40f335a5d3b36be9eea94f2e9b5d2b02ebf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d42f1722fd626c37aa6713e0fa15c40f335a5d3b36be9eea94f2e9b5d2b02ebf.dll,#1
  2⤵
  PID:4980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads