a6ead3dcd4682e81d3fb62ba48ea3d832b52f6effb9cd7dd80652905b6cc5b89 | Triage

Analysis

max time kernel
148s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 18:19

Sharing

Report Analysis Logs

General

Target

a6ead3dcd4682e81d3fb62ba48ea3d832b52f6effb9cd7dd80652905b6cc5b89.dll
Size

3KB
MD5

fe0b449a3d8e018db5465f07bff8ab78
SHA1

05a25093b5f36f9c81bbf281b499c19a56256261
SHA256

a6ead3dcd4682e81d3fb62ba48ea3d832b52f6effb9cd7dd80652905b6cc5b89
SHA512

3b992d0699f70014c5dddd5bcd5c35ee47f26e1b7db88cee0168cec2035f727a69bbc24ec166729aedfc4b6e1345ae1cc239acb5f7843810e9296df7df7db7a9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 2016	1436	rundll32.exe	80
PID 1436 wrote to memory of 2016	1436	rundll32.exe	80
PID 1436 wrote to memory of 2016	1436	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6ead3dcd4682e81d3fb62ba48ea3d832b52f6effb9cd7dd80652905b6cc5b89.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6ead3dcd4682e81d3fb62ba48ea3d832b52f6effb9cd7dd80652905b6cc5b89.dll,#1
  2⤵
  PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads