817d5e921bce72c1da58d69440658fa73233a4143594b2779025f77a7fff1a72 | Triage

Analysis

max time kernel
176s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 02:14

Sharing

Report Analysis Logs

General

Target

817d5e921bce72c1da58d69440658fa73233a4143594b2779025f77a7fff1a72.dll
Size

3KB
MD5

c71b9f6d70fa355f603f821ae7d9c3a0
SHA1

795c59bb26b395ec4d29f614a6256c47bcc2a8bc
SHA256

817d5e921bce72c1da58d69440658fa73233a4143594b2779025f77a7fff1a72
SHA512

670de076578de311896018a922751081bd4452289a1f95a9a686f16c85df7fbf6ad1091808431956cbc5d756537f6bf26b014a40b3b102b32f70b048d4061ee0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 4744	1120	rundll32.exe	80
PID 1120 wrote to memory of 4744	1120	rundll32.exe	80
PID 1120 wrote to memory of 4744	1120	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\817d5e921bce72c1da58d69440658fa73233a4143594b2779025f77a7fff1a72.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\817d5e921bce72c1da58d69440658fa73233a4143594b2779025f77a7fff1a72.dll,#1
  2⤵
  PID:4744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4744-132-0x0000000000000000-mapping.dmp

Download