c7c5d0593e12ca74903a4b247b9e996e7de78e784184eac6a7637deaec9814fd | Triage

Analysis

max time kernel
159s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c7c5d0593e12ca74903a4b247b9e996e7de78e784184eac6a7637deaec9814fd.dll
Size

4KB
MD5

a36c80dfd72d72886d33df64cd435360
SHA1

b8cab50c0a5774a27fac959a2fad009e5d2025fc
SHA256

c7c5d0593e12ca74903a4b247b9e996e7de78e784184eac6a7637deaec9814fd
SHA512

2f72c1b642a683f9e78b1029aaac0701f25cee7b66fae58181328fcdee2ea9e9e0e3472d138b5315c77df36b45e632e8873156cdb07f543cb3137d9cba5b7c90

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 384	2656	rundll32.exe	81
PID 2656 wrote to memory of 384	2656	rundll32.exe	81
PID 2656 wrote to memory of 384	2656	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c7c5d0593e12ca74903a4b247b9e996e7de78e784184eac6a7637deaec9814fd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c7c5d0593e12ca74903a4b247b9e996e7de78e784184eac6a7637deaec9814fd.dll,#1
  2⤵
  PID:384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads