9eeb660ab9fd1cb9562dd46f38d231b8ba9b22a4721b56b3b72ff499286214da | Triage

Analysis

max time kernel
152s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 00:19

Sharing

Report Analysis Logs

General

Target

9eeb660ab9fd1cb9562dd46f38d231b8ba9b22a4721b56b3b72ff499286214da.dll
Size

4KB
MD5

9fa5fa38ec28a4430605809e4f4c4680
SHA1

41d92060397003d0f8fb2ef427581be0860d6856
SHA256

9eeb660ab9fd1cb9562dd46f38d231b8ba9b22a4721b56b3b72ff499286214da
SHA512

2664fdde67c48cc34ecb3901989409e2481a7d333f8ec5eb7882b13bbd8863e03a16e6e4f474d346190f03af6fd593714b38146381645583e67e5181c04996cf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 1124	4400	rundll32.exe	81
PID 4400 wrote to memory of 1124	4400	rundll32.exe	81
PID 4400 wrote to memory of 1124	4400	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9eeb660ab9fd1cb9562dd46f38d231b8ba9b22a4721b56b3b72ff499286214da.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9eeb660ab9fd1cb9562dd46f38d231b8ba9b22a4721b56b3b72ff499286214da.dll,#1
  2⤵
  PID:1124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads