d6ab0424e19245373087929f6e3a4c5f3f3e9eaff9c477a74f8889a3eb660e27 | Triage

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 21:38

Sharing

Report Analysis Logs

General

Target

d6ab0424e19245373087929f6e3a4c5f3f3e9eaff9c477a74f8889a3eb660e27.dll
Size

3KB
MD5

b60e200066a2e28822cf3f68f0d30600
SHA1

196cbdee6dba9fc47570e73269ecf0f2986d06ca
SHA256

d6ab0424e19245373087929f6e3a4c5f3f3e9eaff9c477a74f8889a3eb660e27
SHA512

84a6015f004b93f92204e9f1c71557e7f826dd50bec855e9d1d6a52110cf2d8c8ed80c856456efa65738744cc634ef2d780d2f52e0674c31be6d269221f28e1d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 2576	3248	rundll32.exe	83
PID 3248 wrote to memory of 2576	3248	rundll32.exe	83
PID 3248 wrote to memory of 2576	3248	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6ab0424e19245373087929f6e3a4c5f3f3e9eaff9c477a74f8889a3eb660e27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6ab0424e19245373087929f6e3a4c5f3f3e9eaff9c477a74f8889a3eb660e27.dll,#1
  2⤵
  PID:2576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads