1f22137a2fe224adb11eec1224e9eea9f97dfb7b72099a05b881d4ced5cfdf6e | Triage

Analysis

max time kernel
149s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 21:42

Sharing

Report Analysis Logs

General

Target

1f22137a2fe224adb11eec1224e9eea9f97dfb7b72099a05b881d4ced5cfdf6e.dll
Size

3KB
MD5

5baea4a56df2b72b66484d5fc400e980
SHA1

b5ede18fd6034213f800c7b1608db816229ff0b5
SHA256

1f22137a2fe224adb11eec1224e9eea9f97dfb7b72099a05b881d4ced5cfdf6e
SHA512

9ab9f81c07eb46e115e5a424df86cbfbb910957490f625dee32522dcea643061c901cb12f4a2ef56af8225cb334513f6599570f2df17a888b53b26c6e0495434

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 4700	4508	rundll32.exe	78
PID 4508 wrote to memory of 4700	4508	rundll32.exe	78
PID 4508 wrote to memory of 4700	4508	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f22137a2fe224adb11eec1224e9eea9f97dfb7b72099a05b881d4ced5cfdf6e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f22137a2fe224adb11eec1224e9eea9f97dfb7b72099a05b881d4ced5cfdf6e.dll,#1
  2⤵
  PID:4700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads