f2f723c3936cd0bdd593d3ec0d3eb25ad09806f596a27e38b0cb3e33fbaadb79 | Triage

Analysis

max time kernel
153s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 01:45

Sharing

Report Analysis Logs

General

Target

f2f723c3936cd0bdd593d3ec0d3eb25ad09806f596a27e38b0cb3e33fbaadb79.dll
Size

3KB
MD5

a7db5dedc671fe2a6cb5ce58c1185e30
SHA1

dcb88fdd90a4e48bc0e62ca74d18ae9ba1d9e5c8
SHA256

f2f723c3936cd0bdd593d3ec0d3eb25ad09806f596a27e38b0cb3e33fbaadb79
SHA512

8dc651a50efeed44243514c11c62d79a444e1d46a9c3e0ea0242248fd5bdbebc1e1f951fcf6534a5c8b5a32c06e9f360c235717cbe6511ee6c8970584f60a4b4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1432	1456	rundll32.exe	82
PID 1456 wrote to memory of 1432	1456	rundll32.exe	82
PID 1456 wrote to memory of 1432	1456	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2f723c3936cd0bdd593d3ec0d3eb25ad09806f596a27e38b0cb3e33fbaadb79.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2f723c3936cd0bdd593d3ec0d3eb25ad09806f596a27e38b0cb3e33fbaadb79.dll,#1
  2⤵
  PID:1432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads