325c5bc02bfc1911d6e1cdc0e559d52f2bebd934ec5a33b7342a2aef549fb64f | Triage

Analysis

max time kernel
146s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 15:11

Sharing

Report Analysis Logs

General

Target

325c5bc02bfc1911d6e1cdc0e559d52f2bebd934ec5a33b7342a2aef549fb64f.dll
Size

3KB
MD5

80ce3bb26a9c8b0a0f2096d5dcb48360
SHA1

12f3b320686a7648e6553816aaa4dc7b1cfc228e
SHA256

325c5bc02bfc1911d6e1cdc0e559d52f2bebd934ec5a33b7342a2aef549fb64f
SHA512

8a0f87a26b5d2aeb2a8f3949d1a7f72d5934dafbaf5e378b7861678c72b5eaf2ef5079245d27160290d01d7a76810abcfaf4e9599c5fd0ec2440bdaa8b799619

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 1716	1060	rundll32.exe	82
PID 1060 wrote to memory of 1716	1060	rundll32.exe	82
PID 1060 wrote to memory of 1716	1060	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\325c5bc02bfc1911d6e1cdc0e559d52f2bebd934ec5a33b7342a2aef549fb64f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\325c5bc02bfc1911d6e1cdc0e559d52f2bebd934ec5a33b7342a2aef549fb64f.dll,#1
  2⤵
  PID:1716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads