fbd60cb4e25c398f0e90a470c0241fc97c6a44c9c8e1103dac7603fcdc12fbf0 | Triage

Analysis

max time kernel
189s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 22:02

Sharing

Report Analysis Logs

General

Target

fbd60cb4e25c398f0e90a470c0241fc97c6a44c9c8e1103dac7603fcdc12fbf0.dll
Size

4KB
MD5

ed5eb8b3fef2369fc47069d1a34bab70
SHA1

38ada6983cb0a728a0179b85ab3db89016d79443
SHA256

fbd60cb4e25c398f0e90a470c0241fc97c6a44c9c8e1103dac7603fcdc12fbf0
SHA512

24d5b0f05d5b8f2afedda2a790b895886c2ea1f41d605a16981617e7d12dd8ad1dd049c5d79659571cfb3656d520021a76bc6a52af00d05bac4e5e6aa98c22f6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2644	1720	rundll32.exe	82
PID 1720 wrote to memory of 2644	1720	rundll32.exe	82
PID 1720 wrote to memory of 2644	1720	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbd60cb4e25c398f0e90a470c0241fc97c6a44c9c8e1103dac7603fcdc12fbf0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbd60cb4e25c398f0e90a470c0241fc97c6a44c9c8e1103dac7603fcdc12fbf0.dll,#1
  2⤵
  PID:2644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads