76aa747afac634b99bbf57b4c4fdd1cfae8cc4b1270ba0f49e03b31a6be018bc | Triage

Analysis

max time kernel
153s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 11:03

Sharing

Report Analysis Logs

General

Target

76aa747afac634b99bbf57b4c4fdd1cfae8cc4b1270ba0f49e03b31a6be018bc.dll
Size

3KB
MD5

c7006e50b84843f5a1fd313bf03e79f0
SHA1

844270b2792cd697958cf86347f0e9226b6a3634
SHA256

76aa747afac634b99bbf57b4c4fdd1cfae8cc4b1270ba0f49e03b31a6be018bc
SHA512

98446cb38185d3898fc7870d3ad79666da0b3ce75a92e02f0dc1473318f1a92f80032c1a5e2ac0abdd53035bbb097bec1c4e139658b3fb4dea9c385af37b178d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 3848	4532	rundll32.exe	81
PID 4532 wrote to memory of 3848	4532	rundll32.exe	81
PID 4532 wrote to memory of 3848	4532	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\76aa747afac634b99bbf57b4c4fdd1cfae8cc4b1270ba0f49e03b31a6be018bc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\76aa747afac634b99bbf57b4c4fdd1cfae8cc4b1270ba0f49e03b31a6be018bc.dll,#1
  2⤵
  PID:3848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads