5fb70ca5092b223e18a171f120dfd2b167daa1ce8f703ff95b544d4fd0ef548f | Triage

Analysis

max time kernel
178s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 15:09

Sharing

Report Analysis Logs

General

Target

5fb70ca5092b223e18a171f120dfd2b167daa1ce8f703ff95b544d4fd0ef548f.dll
Size

3KB
MD5

be89cbae13531f63b54b9636f4419ab0
SHA1

7426dde1fa67d799879e12c07747396a9ca8d1cf
SHA256

5fb70ca5092b223e18a171f120dfd2b167daa1ce8f703ff95b544d4fd0ef548f
SHA512

0aa7a8650d876691a2d02db16816e7e9a56d09dbd9acc0f04f608053d18484d4d8ef0bc6dca5a49c240baac577f6342e5e6454f2aaef0e18cd81c4c030901b0b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 4800	1552	rundll32.exe	82
PID 1552 wrote to memory of 4800	1552	rundll32.exe	82
PID 1552 wrote to memory of 4800	1552	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fb70ca5092b223e18a171f120dfd2b167daa1ce8f703ff95b544d4fd0ef548f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fb70ca5092b223e18a171f120dfd2b167daa1ce8f703ff95b544d4fd0ef548f.dll,#1
  2⤵
  PID:4800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4800-132-0x0000000000000000-mapping.dmp

Download