2f8182f09f4b7f3dfea65e99d2dfd1603a11dfaf8ebbafa6090df4a7f48f6095 | Triage

Analysis

max time kernel
94s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 00:21

Sharing

Report Analysis Logs

General

Target

2f8182f09f4b7f3dfea65e99d2dfd1603a11dfaf8ebbafa6090df4a7f48f6095.dll
Size

960B
MD5

a36148e92169b5e49f5dcd45d6384fd0
SHA1

1982f038339bdfc9279ac828fe7d98f46d585030
SHA256

2f8182f09f4b7f3dfea65e99d2dfd1603a11dfaf8ebbafa6090df4a7f48f6095
SHA512

02194eccd47c6fbe93fbcb5d51b76213925398f8ba46c42fe696c1eea5fa2766a6e41bc126950ddfc4555afd6c3fa1e05887bd95bb459445c1c8f1b35a876413

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 1604	4260	rundll32.exe	79
PID 4260 wrote to memory of 1604	4260	rundll32.exe	79
PID 4260 wrote to memory of 1604	4260	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f8182f09f4b7f3dfea65e99d2dfd1603a11dfaf8ebbafa6090df4a7f48f6095.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f8182f09f4b7f3dfea65e99d2dfd1603a11dfaf8ebbafa6090df4a7f48f6095.dll,#1
  2⤵
  PID:1604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads