88604d32aa228d0b2c046609d392a99d184b916c62fa476967dce908addf4503 | Triage

Analysis

max time kernel
156s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 21:48

Sharing

Report Analysis Logs

General

Target

88604d32aa228d0b2c046609d392a99d184b916c62fa476967dce908addf4503.dll
Size

3KB
MD5

c2aa256bd41b0fb68b72578a2d5fb537
SHA1

9b3156dbdfbb310c98d613cf5150448fba923400
SHA256

88604d32aa228d0b2c046609d392a99d184b916c62fa476967dce908addf4503
SHA512

0cbcb693abc74c96b2cbcd345ba16eaa91dc16b7a42279826733e8a2bfc43b7dbcf63d46db21ebb18899acaa5a1b75f61f8a730b03f97e869287cf9cb8a24d34

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 3956	2116	rundll32.exe	82
PID 2116 wrote to memory of 3956	2116	rundll32.exe	82
PID 2116 wrote to memory of 3956	2116	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\88604d32aa228d0b2c046609d392a99d184b916c62fa476967dce908addf4503.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\88604d32aa228d0b2c046609d392a99d184b916c62fa476967dce908addf4503.dll,#1
  2⤵
  PID:3956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads