b6b52e1038d28751a7f1523d331babcf41edc4b0de6a83e1ed847bb0047d3944 | Triage

Analysis

max time kernel
159s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 22:29

Sharing

Report Analysis Logs

General

Target

b6b52e1038d28751a7f1523d331babcf41edc4b0de6a83e1ed847bb0047d3944.dll
Size

3KB
MD5

9425c046bd77b207bdcd8c2679cfb7b0
SHA1

6e4efb067d828f885b18a49bafd17d1d0e866470
SHA256

b6b52e1038d28751a7f1523d331babcf41edc4b0de6a83e1ed847bb0047d3944
SHA512

d6a789ebe1cbebb9a174f69f42b0e1bc48ab2a1592e33369cc6183273af2eaa789ef30c171f153ad5ae88aa1073e51c45f998ece766515d76162eb213cad1732

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2244	2792	rundll32.exe	78
PID 2792 wrote to memory of 2244	2792	rundll32.exe	78
PID 2792 wrote to memory of 2244	2792	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6b52e1038d28751a7f1523d331babcf41edc4b0de6a83e1ed847bb0047d3944.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6b52e1038d28751a7f1523d331babcf41edc4b0de6a83e1ed847bb0047d3944.dll,#1
  2⤵
  PID:2244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads