667947547640b61187e0aed5e214efe5d4d1e3bc464f2204af2ca8f83e588043 | Triage

Analysis

max time kernel
274s
max time network
336s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 23:01

Sharing

Report Analysis Logs

General

Target

667947547640b61187e0aed5e214efe5d4d1e3bc464f2204af2ca8f83e588043.dll
Size

3KB
MD5

944a57055cdcc83c39433e37cfb676b0
SHA1

37360194fa8312570cf82c989e31ae532270bb8f
SHA256

667947547640b61187e0aed5e214efe5d4d1e3bc464f2204af2ca8f83e588043
SHA512

68846d94dc955c39b39920e30017bcea8cf7f9ae60dd718f8848e94110b866f6c256f3d0beb32056afb836ce6dc784315ca5c6deee40d9cc833e2eb478d252d3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 4388	4448	rundll32.exe	81
PID 4448 wrote to memory of 4388	4448	rundll32.exe	81
PID 4448 wrote to memory of 4388	4448	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\667947547640b61187e0aed5e214efe5d4d1e3bc464f2204af2ca8f83e588043.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\667947547640b61187e0aed5e214efe5d4d1e3bc464f2204af2ca8f83e588043.dll,#1
  2⤵
  PID:4388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4388-132-0x0000000000000000-mapping.dmp

Download