cd9c9143a48fd20d09b0553854fdcf56c69a20c43bfde456e4a0459e7bf6f532 | Triage

Analysis

max time kernel
169s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 18:17

Sharing

Report Analysis Logs

General

Target

cd9c9143a48fd20d09b0553854fdcf56c69a20c43bfde456e4a0459e7bf6f532.dll
Size

3KB
MD5

f44d0f4744a7c53e0bcbaffb7e9295fb
SHA1

a5f9b6f8544b2d1b017541e9a464a598135de580
SHA256

cd9c9143a48fd20d09b0553854fdcf56c69a20c43bfde456e4a0459e7bf6f532
SHA512

74b22bd7540af296ba5627226f6b08ea18e5664d56eb127cde4b62450547514a2cd4669710bc6708b7dbbec801341e83d0a0fd1a142299487a800b28d0dfaa1f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 1420	3052	rundll32.exe	84
PID 3052 wrote to memory of 1420	3052	rundll32.exe	84
PID 3052 wrote to memory of 1420	3052	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd9c9143a48fd20d09b0553854fdcf56c69a20c43bfde456e4a0459e7bf6f532.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd9c9143a48fd20d09b0553854fdcf56c69a20c43bfde456e4a0459e7bf6f532.dll,#1
  2⤵
  PID:1420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads