b4c3c63352d7bb9c6b21c61ea982cb3177fd868f1f5b55745c321958675eb50b | Triage

Analysis

max time kernel
178s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 23:28

Sharing

Report Analysis Logs

General

Target

b4c3c63352d7bb9c6b21c61ea982cb3177fd868f1f5b55745c321958675eb50b.dll
Size

3KB
MD5

56abe087548320eeb2cb602a1d487a00
SHA1

05fd2f67ac41bf29eff5310ed04ba680909b6944
SHA256

b4c3c63352d7bb9c6b21c61ea982cb3177fd868f1f5b55745c321958675eb50b
SHA512

49a3257ff1e9d06fd374c670edfb67e244e16a8696950c60aaf813c369ffdcfb338582ecda887180a91e8d7e33d55c63fb8c74d29d944b7c09c85f54a0de1cbe

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 672	4220	rundll32.exe	81
PID 4220 wrote to memory of 672	4220	rundll32.exe	81
PID 4220 wrote to memory of 672	4220	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4c3c63352d7bb9c6b21c61ea982cb3177fd868f1f5b55745c321958675eb50b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4c3c63352d7bb9c6b21c61ea982cb3177fd868f1f5b55745c321958675eb50b.dll,#1
  2⤵
  PID:672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads