aa7eb2e34afd1b9667917d96bb08604d347237d20e45f4ce878060de2329f642 | Triage

Analysis

max time kernel
90s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 02:04

Sharing

Report Analysis Logs

General

Target

aa7eb2e34afd1b9667917d96bb08604d347237d20e45f4ce878060de2329f642.dll
Size

3KB
MD5

2bbcf13eda961969fd2856ddc4afc190
SHA1

6533f02a3e3589eb37ecd27a1eace50d415fb033
SHA256

aa7eb2e34afd1b9667917d96bb08604d347237d20e45f4ce878060de2329f642
SHA512

d40d7d375bb1e66d34903ae7cd8394bb825973bb4804a4ffbb99486dcbdd595c4a6e2749a79c5ea14966fab3f7f043208097d08de28e6ccb63f96bd4108609d0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 5072	5036	rundll32.exe	80
PID 5036 wrote to memory of 5072	5036	rundll32.exe	80
PID 5036 wrote to memory of 5072	5036	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa7eb2e34afd1b9667917d96bb08604d347237d20e45f4ce878060de2329f642.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa7eb2e34afd1b9667917d96bb08604d347237d20e45f4ce878060de2329f642.dll,#1
  2⤵
  PID:5072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5072-132-0x0000000000000000-mapping.dmp

Download