1a49f095e9c18f9960bba6156681f45d665044d442ca9723ac26b4bd88997b92 | Triage™

Analysis

max time kernel
162s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 21:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1a49f095e9c18f9960bba6156681f45d665044d442ca9723ac26b4bd88997b92.dll
Size 3KB
Sample221202-1vwbcscc7x
SHA256 1a49f095e9c18f9960bba6156681f45d665044d442ca9723ac26b4bd88997b92
MD5 ffa601678e80bce990e3f2a8a67de230
SHA1 3ce8600aabffbd4f731fba170665507336b3116d
SHA512 0e0ddfc633d478eb4ebaa6b9baeaedd78c33c86b74bc701895f26d78439246fab032c4b547620201090df74334cd68cadae8e2b85ed16f941cd9440bd8fd36e8
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 2788	4472	rundll32.exe	83
PID 4472 wrote to memory of 2788	4472	rundll32.exe	83
PID 4472 wrote to memory of 2788	4472	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a49f095e9c18f9960bba6156681f45d665044d442ca9723ac26b4bd88997b92.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a49f095e9c18f9960bba6156681f45d665044d442ca9723ac26b4bd88997b92.dll,#1
  2⤵
  PID:2788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads