a923f861fe37a402ea52b0ca036cc59df541e22112f6bc390c0282e1b8b0d22f | Triage

Analysis

max time kernel
168s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 15:07

Sharing

Report Analysis Logs

General

Target

a923f861fe37a402ea52b0ca036cc59df541e22112f6bc390c0282e1b8b0d22f.dll
Size

3KB
MD5

ad0931b1e6a88680e8cfceef59e063c0
SHA1

c8ffa53c86985a2eb3d1c14486f7b7f566e7abc7
SHA256

a923f861fe37a402ea52b0ca036cc59df541e22112f6bc390c0282e1b8b0d22f
SHA512

b1320c5ac45b1ae6faad78e115d36d55b69b61df50dac57e99948b1660ecbe5dba2bb7d83bdb1f4a1d143112db2dfae3a8f6c285a368ee545404db9b68ade692

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 1944	4088	rundll32.exe	81
PID 4088 wrote to memory of 1944	4088	rundll32.exe	81
PID 4088 wrote to memory of 1944	4088	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a923f861fe37a402ea52b0ca036cc59df541e22112f6bc390c0282e1b8b0d22f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a923f861fe37a402ea52b0ca036cc59df541e22112f6bc390c0282e1b8b0d22f.dll,#1
  2⤵
  PID:1944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads