447e9022ba900c49a8cd05460376e80c42af3152878b9417736ad9f9ed7ae0ea | Triage

Analysis

max time kernel
247s
max time network
266s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 10:56

Sharing

Report Analysis Logs

General

Target

447e9022ba900c49a8cd05460376e80c42af3152878b9417736ad9f9ed7ae0ea.dll
Size

4KB
MD5

8911e530f8bc6e32ed85a371e8a5ff50
SHA1

03c68e12a09aa493d23ec31dffed8ac1f931517a
SHA256

447e9022ba900c49a8cd05460376e80c42af3152878b9417736ad9f9ed7ae0ea
SHA512

0756e0e293564240fe59ee9934c583c523d2271cdfafd90370567159d82efb490d98e10cb40d27fae4066e41cb1117738649a139527d145109432d200a816137

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 3512	400	rundll32.exe	81
PID 400 wrote to memory of 3512	400	rundll32.exe	81
PID 400 wrote to memory of 3512	400	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\447e9022ba900c49a8cd05460376e80c42af3152878b9417736ad9f9ed7ae0ea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\447e9022ba900c49a8cd05460376e80c42af3152878b9417736ad9f9ed7ae0ea.dll,#1
  2⤵
  PID:3512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads