cb2d0893a940cead9d3c749dfa6e3440d7b55abe16dc89706007a02578de8464 | Triage

Analysis

max time kernel
146s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 18:24

Sharing

Report Analysis Logs

General

Target

cb2d0893a940cead9d3c749dfa6e3440d7b55abe16dc89706007a02578de8464.dll
Size

3KB
MD5

fecc6b1ff973551d5e52d6b6bea7e1a5
SHA1

2cd1a1573da84c48e9906cba9a63d4d4b6c856b2
SHA256

cb2d0893a940cead9d3c749dfa6e3440d7b55abe16dc89706007a02578de8464
SHA512

27f81b53467bb5823eb4109b0722c2ebc67eef377078e5168a3bf0eb194fcfea96bbef1e43b3f9169b8a226fb4d37eccfa3d4eeb0165a856ee93530316d7686b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 4412	4460	rundll32.exe	80
PID 4460 wrote to memory of 4412	4460	rundll32.exe	80
PID 4460 wrote to memory of 4412	4460	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb2d0893a940cead9d3c749dfa6e3440d7b55abe16dc89706007a02578de8464.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb2d0893a940cead9d3c749dfa6e3440d7b55abe16dc89706007a02578de8464.dll,#1
  2⤵
  PID:4412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads