a0835ddb8b7f5e5e4b8046e9484d0ba15037c4bbf8f66905113e56f3d79f7b68 | Triage

Analysis

max time kernel
158s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 00:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a0835ddb8b7f5e5e4b8046e9484d0ba15037c4bbf8f66905113e56f3d79f7b68.dll
Size

4KB
MD5

c20e4d9c99d4a8986292918c99e33ac0
SHA1

812941d531b2048494ff2eaa81547ee790fa1d49
SHA256

a0835ddb8b7f5e5e4b8046e9484d0ba15037c4bbf8f66905113e56f3d79f7b68
SHA512

57f9a68e63b412fc31503d89eea054958487de2a5d94b24d2f391816890b2455f49b3bc3f017b146baa4564ce85050571d38d83116115eaf341786d99645b491

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 4324	4272	rundll32.exe	82
PID 4272 wrote to memory of 4324	4272	rundll32.exe	82
PID 4272 wrote to memory of 4324	4272	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0835ddb8b7f5e5e4b8046e9484d0ba15037c4bbf8f66905113e56f3d79f7b68.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0835ddb8b7f5e5e4b8046e9484d0ba15037c4bbf8f66905113e56f3d79f7b68.dll,#1
  2⤵
  PID:4324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads