a096d3642a56d9119964802852d3bf1946613b02646befea1dbe8f951449c954 | Triage

Analysis

max time kernel
167s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 21:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a096d3642a56d9119964802852d3bf1946613b02646befea1dbe8f951449c954.dll
Size

3KB
MD5

3051037ddaec8e2cc45b94a3fdf3734e
SHA1

afb46431277f2c98e0ed114bf56703cffbf36641
SHA256

a096d3642a56d9119964802852d3bf1946613b02646befea1dbe8f951449c954
SHA512

875b433c916d73b3660f6f38061587f2b4dcfb1969b55635ac20310ecf8219b648b58cfe0ac1eb43a9202eef83d6025560a06ea3136c109cc9214627ae7c9a78

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 1948	4996	rundll32.exe	82
PID 4996 wrote to memory of 1948	4996	rundll32.exe	82
PID 4996 wrote to memory of 1948	4996	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a096d3642a56d9119964802852d3bf1946613b02646befea1dbe8f951449c954.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a096d3642a56d9119964802852d3bf1946613b02646befea1dbe8f951449c954.dll,#1
  2⤵
  PID:1948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads