f952ac8308f7e7522b13c4826deeaa8dcc7a1d6a1bd1eced6dd26570112c4d14 | Triage

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 01:44

Sharing

Report Analysis Logs

General

Target

f952ac8308f7e7522b13c4826deeaa8dcc7a1d6a1bd1eced6dd26570112c4d14.dll
Size

3KB
MD5

c8e18f391cda874e2780eb5a86befc30
SHA1

074cf34610522e57a4a9e13beaee2dcffa1db7d3
SHA256

f952ac8308f7e7522b13c4826deeaa8dcc7a1d6a1bd1eced6dd26570112c4d14
SHA512

f6be9ecfe2d4a3b8d162fecbe3519e1ce221219e4fee54b1adc3aca44f90c183aee47cf07306cb5ef87f47922c1dfa20aa1d84c6f360d10b6881d2d24da53748

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 1108	3912	rundll32.exe	76
PID 3912 wrote to memory of 1108	3912	rundll32.exe	76
PID 3912 wrote to memory of 1108	3912	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f952ac8308f7e7522b13c4826deeaa8dcc7a1d6a1bd1eced6dd26570112c4d14.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f952ac8308f7e7522b13c4826deeaa8dcc7a1d6a1bd1eced6dd26570112c4d14.dll,#1
  2⤵
  PID:1108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads