6f25c53cf08d3da5acf7c4acd1f2d2944e44eee3046eb8fb91472e2bf72dbf34 | Triage

Analysis

max time kernel
173s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 00:25

Sharing

Report Analysis Logs

General

Target

6f25c53cf08d3da5acf7c4acd1f2d2944e44eee3046eb8fb91472e2bf72dbf34.dll
Size

4KB
MD5

5279ce9acfa7a16892e5f583941cc610
SHA1

f1d569abe6047bec0a33d554b6f263ab10c2d0ab
SHA256

6f25c53cf08d3da5acf7c4acd1f2d2944e44eee3046eb8fb91472e2bf72dbf34
SHA512

8977db032134336747b348f746e8211cd4839e093ceae465b5af990fb67b4a34084adc1c6c031c8247abf6c88fdf00cea3e952d67ee4b54ad02fbf58b864f3ed

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 4108	1472	rundll32.exe	28
PID 1472 wrote to memory of 4108	1472	rundll32.exe	28
PID 1472 wrote to memory of 4108	1472	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f25c53cf08d3da5acf7c4acd1f2d2944e44eee3046eb8fb91472e2bf72dbf34.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f25c53cf08d3da5acf7c4acd1f2d2944e44eee3046eb8fb91472e2bf72dbf34.dll,#1
  2⤵
  PID:4108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads