d14b6d2355c289076aafa97b5886e94d5e9198ca3dfca0df5a30e08db367d9cd | Triage

Analysis

max time kernel
270s
max time network
386s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 15:06

Sharing

Report Analysis Logs

General

Target

d14b6d2355c289076aafa97b5886e94d5e9198ca3dfca0df5a30e08db367d9cd.dll
Size

3KB
MD5

e51ae4326228f8820210f6e5530a2f10
SHA1

4492bb683935871215b503368a94062d2cae928a
SHA256

d14b6d2355c289076aafa97b5886e94d5e9198ca3dfca0df5a30e08db367d9cd
SHA512

bd9c4268cca17bf4a5f4a702d73b38647c2064d1dd7bfc5c3cee81f19b9433c19083f2b2dfb4b27126769eed7b71d5c40c1ea055f8831ac4c443f7c92efc51a6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1772	1300	rundll32.exe	79
PID 1300 wrote to memory of 1772	1300	rundll32.exe	79
PID 1300 wrote to memory of 1772	1300	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d14b6d2355c289076aafa97b5886e94d5e9198ca3dfca0df5a30e08db367d9cd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d14b6d2355c289076aafa97b5886e94d5e9198ca3dfca0df5a30e08db367d9cd.dll,#1
  2⤵
  PID:1772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads