c05b2173ad7f07faa11a69abd5f420d6da9cba932f887691430d17d4753a62bb | Triage

Analysis

max time kernel
203s
max time network
240s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 21:54

Sharing

Report Analysis Logs

General

Target

c05b2173ad7f07faa11a69abd5f420d6da9cba932f887691430d17d4753a62bb.dll
Size

3KB
MD5

eb2044c4d11e7ba0a2fdde4366f69331
SHA1

686dcde8e2bc27965f033e9306d6ddea0f5e98fa
SHA256

c05b2173ad7f07faa11a69abd5f420d6da9cba932f887691430d17d4753a62bb
SHA512

23316cca8ae0a8ee73f2108a79f4b5f0a99f810a4a1348e426676d34779223a91d30c23d44d803db864c0d49efa9a702487935274e4badcc207e117e1874f1cb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 3732	5084	rundll32.exe	81
PID 5084 wrote to memory of 3732	5084	rundll32.exe	81
PID 5084 wrote to memory of 3732	5084	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c05b2173ad7f07faa11a69abd5f420d6da9cba932f887691430d17d4753a62bb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c05b2173ad7f07faa11a69abd5f420d6da9cba932f887691430d17d4753a62bb.dll,#1
  2⤵
  PID:3732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads