987745b5176b434244efe63541be709f7bc0cdf4b57b44f6523d1b1b2bfd9580 | Triage

Analysis

max time kernel
162s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 18:19

Sharing

Report Analysis Logs

General

Target

987745b5176b434244efe63541be709f7bc0cdf4b57b44f6523d1b1b2bfd9580.dll
Size

3KB
MD5

f1dae4fc2f25b90039de93b91ce5f437
SHA1

7d4701bcc5c64f64839c290c9bab8a5385e9711e
SHA256

987745b5176b434244efe63541be709f7bc0cdf4b57b44f6523d1b1b2bfd9580
SHA512

1288a758ecb10830020bde161b1a76d7bd685c611bb4936c4be0886ea43671cc1034a3fba5e5cb3fd9575e8fc29b26257686a63fafb248f3f620f54e1582750e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 2604	4636	rundll32.exe	82
PID 4636 wrote to memory of 2604	4636	rundll32.exe	82
PID 4636 wrote to memory of 2604	4636	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\987745b5176b434244efe63541be709f7bc0cdf4b57b44f6523d1b1b2bfd9580.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\987745b5176b434244efe63541be709f7bc0cdf4b57b44f6523d1b1b2bfd9580.dll,#1
  2⤵
  PID:2604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads