b893806d0b8e4b6cfcd0d630878a3c8ca627e4ae974fe0ea62caa569f322a489 | Triage

Analysis

max time kernel
115s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 21:39

Sharing

Report Analysis Logs

General

Target

b893806d0b8e4b6cfcd0d630878a3c8ca627e4ae974fe0ea62caa569f322a489.dll
Size

3KB
MD5

b3e98bf3d1ca0bbbf77d03f94da013e0
SHA1

11ec78f966407dc836118f893db34014e62fa3a1
SHA256

b893806d0b8e4b6cfcd0d630878a3c8ca627e4ae974fe0ea62caa569f322a489
SHA512

2ae0a34c2d64650412daa7da089885a883c4aa4d92e7f1cf8cdd6b3f8bef619b675e53faca022d97334881ae1cdc367ae3ba45baf4d956192e906c24537618c6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 840	2284	rundll32.exe	80
PID 2284 wrote to memory of 840	2284	rundll32.exe	80
PID 2284 wrote to memory of 840	2284	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b893806d0b8e4b6cfcd0d630878a3c8ca627e4ae974fe0ea62caa569f322a489.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b893806d0b8e4b6cfcd0d630878a3c8ca627e4ae974fe0ea62caa569f322a489.dll,#1
  2⤵
  PID:840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads