4d178a99bf68e73be56d7620eecf76b3dbd606a74a450e88929915b34d380504 | Triage

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 23:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4d178a99bf68e73be56d7620eecf76b3dbd606a74a450e88929915b34d380504.dll
Size

3KB
MD5

ef8fd462eea6f574b1820f5660372ae0
SHA1

3e57d0bc9184c2ebc071329322442aa896e3d09a
SHA256

4d178a99bf68e73be56d7620eecf76b3dbd606a74a450e88929915b34d380504
SHA512

18d73ffa388ac900f6490e750f54cd6a74b58e85d36f59501e5e1ae2f06e5a641e776f948c188f4c73662faa61ef9d731d9b61038bee0bfb59160561b19aa486

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 2824	3836	rundll32.exe	15
PID 3836 wrote to memory of 2824	3836	rundll32.exe	15
PID 3836 wrote to memory of 2824	3836	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d178a99bf68e73be56d7620eecf76b3dbd606a74a450e88929915b34d380504.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d178a99bf68e73be56d7620eecf76b3dbd606a74a450e88929915b34d380504.dll,#1
  2⤵
  PID:2824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads