1a49f095e9c18f9960bba6156681f45d665044d442ca9723ac26b4bd88997b92 | Triage

Analysis

max time kernel
162s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 21:58

Sharing

Report Analysis Logs

General

Target

1a49f095e9c18f9960bba6156681f45d665044d442ca9723ac26b4bd88997b92.dll
Size

3KB
MD5

ffa601678e80bce990e3f2a8a67de230
SHA1

3ce8600aabffbd4f731fba170665507336b3116d
SHA256

1a49f095e9c18f9960bba6156681f45d665044d442ca9723ac26b4bd88997b92
SHA512

0e0ddfc633d478eb4ebaa6b9baeaedd78c33c86b74bc701895f26d78439246fab032c4b547620201090df74334cd68cadae8e2b85ed16f941cd9440bd8fd36e8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 2788	4472	rundll32.exe	83
PID 4472 wrote to memory of 2788	4472	rundll32.exe	83
PID 4472 wrote to memory of 2788	4472	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a49f095e9c18f9960bba6156681f45d665044d442ca9723ac26b4bd88997b92.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a49f095e9c18f9960bba6156681f45d665044d442ca9723ac26b4bd88997b92.dll,#1
  2⤵
  PID:2788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads