6f0515a35173b8fa8b03dc252911dc93011ee1a0040abadc43496c38453246c2 | Triage

Analysis

max time kernel
52s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 15:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6f0515a35173b8fa8b03dc252911dc93011ee1a0040abadc43496c38453246c2.dll
Size

3KB
MD5

4e41d47d858934ab212365034e9b92c0
SHA1

68d9290c3e521b82fd0f17ed117ed562b870acdc
SHA256

6f0515a35173b8fa8b03dc252911dc93011ee1a0040abadc43496c38453246c2
SHA512

ce906980b5e2d2fb10d98c31f16d655be670865fb95cf90e9122121b3d922fa2a9de5fc44a09b9c8091c1a4090ff1514cc9082167bad138c3eca7d46e0337575

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 876	956	rundll32.exe	80
PID 956 wrote to memory of 876	956	rundll32.exe	80
PID 956 wrote to memory of 876	956	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f0515a35173b8fa8b03dc252911dc93011ee1a0040abadc43496c38453246c2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f0515a35173b8fa8b03dc252911dc93011ee1a0040abadc43496c38453246c2.dll,#1
  2⤵
  PID:876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads