bd4875a5734c007e54cafe5be5099bb1224ae2f86bf976f04269ec60fccc0e34 | Triage

Analysis

max time kernel
166s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 23:34

Sharing

Report Analysis Logs

General

Target

bd4875a5734c007e54cafe5be5099bb1224ae2f86bf976f04269ec60fccc0e34.dll
Size

3KB
MD5

ce962dd02e68b9b5f5042439e051eaa0
SHA1

61334b115d2be3d5a638b99c82cb4246ef3180be
SHA256

bd4875a5734c007e54cafe5be5099bb1224ae2f86bf976f04269ec60fccc0e34
SHA512

20e9a4249ed6c508ff190bdaa4a557a3b602fb9b0122d50ad8e0ee64d56b3a8c80ec343b2bbfdbf69ee4b771312aedc0c48c566d5a77004e58ee9489ae671317

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 5116	1272	rundll32.exe	83
PID 1272 wrote to memory of 5116	1272	rundll32.exe	83
PID 1272 wrote to memory of 5116	1272	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd4875a5734c007e54cafe5be5099bb1224ae2f86bf976f04269ec60fccc0e34.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd4875a5734c007e54cafe5be5099bb1224ae2f86bf976f04269ec60fccc0e34.dll,#1
  2⤵
  PID:5116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5116-132-0x0000000000000000-mapping.dmp

Download