8f6ee99b47fc5f740c0bd22950280180ed2ace500c9c72a8b7d1ca5aa17a6671 | Triage

Analysis

max time kernel
187s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 21:40

Sharing

Report Analysis Logs

General

Target

8f6ee99b47fc5f740c0bd22950280180ed2ace500c9c72a8b7d1ca5aa17a6671.dll
Size

3KB
MD5

241da100e2057d547b262b3c2425f200
SHA1

2932d4c1c2998c7b00aeb598e131910bdb793eb1
SHA256

8f6ee99b47fc5f740c0bd22950280180ed2ace500c9c72a8b7d1ca5aa17a6671
SHA512

52562c00fefdd4d8a6f2bbe5dba6b85535e3572f5ffa7c7c58b1dbb25cabebf694e52308e8e22b29d17f54fa40c8f0b9a2c418a0dbe41d43f7dc0e2d421024f6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 3160	3140	rundll32.exe	83
PID 3140 wrote to memory of 3160	3140	rundll32.exe	83
PID 3140 wrote to memory of 3160	3140	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f6ee99b47fc5f740c0bd22950280180ed2ace500c9c72a8b7d1ca5aa17a6671.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f6ee99b47fc5f740c0bd22950280180ed2ace500c9c72a8b7d1ca5aa17a6671.dll,#1
  2⤵
  PID:3160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads