156d0243354ed0ad3e3ba1246660ab2d1388fb8ff56cec6cb72a2c406b0da706 | Triage

Analysis

max time kernel
146s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 21:59

Sharing

Report Analysis Logs

General

Target

156d0243354ed0ad3e3ba1246660ab2d1388fb8ff56cec6cb72a2c406b0da706.dll
Size

3KB
MD5

8776dc7f05921755f54b698f09fde72e
SHA1

2621c3ea09766c9d312d0bdab9cdb0075f676ec4
SHA256

156d0243354ed0ad3e3ba1246660ab2d1388fb8ff56cec6cb72a2c406b0da706
SHA512

4fabdc84eb2a1419fc7fa3d975c1bf72dca59f624083f698b33458ec8fcfe3c12317b5a46337486dde2d0e927f98834554009179af8649f09180e811020a581e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 3772	3056	rundll32.exe	83
PID 3056 wrote to memory of 3772	3056	rundll32.exe	83
PID 3056 wrote to memory of 3772	3056	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\156d0243354ed0ad3e3ba1246660ab2d1388fb8ff56cec6cb72a2c406b0da706.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\156d0243354ed0ad3e3ba1246660ab2d1388fb8ff56cec6cb72a2c406b0da706.dll,#1
  2⤵
  PID:3772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads