92cd54ffa1c96fe993b32ea10e618d5aab79d9c3c07e8230adfd94334707aa63 | Triage

Analysis

max time kernel
149s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 19:15

Sharing

Report Analysis Logs

General

Target

92cd54ffa1c96fe993b32ea10e618d5aab79d9c3c07e8230adfd94334707aa63.dll
Size

3KB
MD5

083aad79612efd746cfa88c59bd02db0
SHA1

2d5ec8e654ae40cfad98214f7163eb94c1868b6a
SHA256

92cd54ffa1c96fe993b32ea10e618d5aab79d9c3c07e8230adfd94334707aa63
SHA512

acc0d90ba05d15c7a37bdd1e62e90095614c061884aca4681dd8617f0e4b7a1b41d3578e792b9e3c52ec502df79999b71dbeca02fec71620bc8a6beae36889d4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1840	2076	rundll32.exe	85
PID 2076 wrote to memory of 1840	2076	rundll32.exe	85
PID 2076 wrote to memory of 1840	2076	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92cd54ffa1c96fe993b32ea10e618d5aab79d9c3c07e8230adfd94334707aa63.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\92cd54ffa1c96fe993b32ea10e618d5aab79d9c3c07e8230adfd94334707aa63.dll,#1
  2⤵
  PID:1840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1840-132-0x0000000000000000-mapping.dmp

Download