72d3f0ef53c3104bb2a1da1e18cda18050eda6a465a00e613d5d57c21908457b | Triage

Analysis

max time kernel
163s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 22:55

Sharing

Report Analysis Logs

General

Target

72d3f0ef53c3104bb2a1da1e18cda18050eda6a465a00e613d5d57c21908457b.dll
Size

3KB
MD5

8c16edcf7481d73e2c70400bd41c4030
SHA1

5fcc09179baff0367479a60544ba5d1571d59d9a
SHA256

72d3f0ef53c3104bb2a1da1e18cda18050eda6a465a00e613d5d57c21908457b
SHA512

d0c4127256db5acd3d7494dce4d683148443b1041f52f4a5be671a45d86be3a6842b11a6ea218458c91b7f2f4afa3afade53dbff136f725e93765f14a12ab930

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 1168	2584	rundll32.exe	83
PID 2584 wrote to memory of 1168	2584	rundll32.exe	83
PID 2584 wrote to memory of 1168	2584	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72d3f0ef53c3104bb2a1da1e18cda18050eda6a465a00e613d5d57c21908457b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\72d3f0ef53c3104bb2a1da1e18cda18050eda6a465a00e613d5d57c21908457b.dll,#1
  2⤵
  PID:1168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads