b63b31679c8572e69e36e67cf8058d083a25d9b7ffa323b5fed10db5322c06ae | Triage

Analysis

max time kernel
147s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 21:39

Sharing

Report Analysis Logs

General

Target

b63b31679c8572e69e36e67cf8058d083a25d9b7ffa323b5fed10db5322c06ae.dll
Size

3KB
MD5

2f59751c2a37e54fb82fd3c4f7cf5c70
SHA1

380239febd6da9365c73bd05c3bad2e2282492e3
SHA256

b63b31679c8572e69e36e67cf8058d083a25d9b7ffa323b5fed10db5322c06ae
SHA512

5c43f9e5eb3bd9554f2404ecd8f1447c53eda92ae31f1884d0bc3ca37790c3f0a59521ec70d7708e73c61e08bfea0ce4302de9b8c11691b8cf86de2e9c1c116f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 4736	1048	rundll32.exe	78
PID 1048 wrote to memory of 4736	1048	rundll32.exe	78
PID 1048 wrote to memory of 4736	1048	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b63b31679c8572e69e36e67cf8058d083a25d9b7ffa323b5fed10db5322c06ae.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b63b31679c8572e69e36e67cf8058d083a25d9b7ffa323b5fed10db5322c06ae.dll,#1
  2⤵
  PID:4736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads