4605cd7bb40fb861d195dabcc9c78c6013555be693569dc655e54589a52a3e86 | Triage

Analysis

max time kernel
112s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 00:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4605cd7bb40fb861d195dabcc9c78c6013555be693569dc655e54589a52a3e86.dll
Size

4KB
MD5

56639537daf8c95a0947853840475c20
SHA1

0d4645c88750a5b6b7dab9122510b22a0fd1be97
SHA256

4605cd7bb40fb861d195dabcc9c78c6013555be693569dc655e54589a52a3e86
SHA512

f67f169b23c505545249d7aec6c3f39a25d2b0ed6d932f377a0063f689e18493329380513c1c69398cba6ea42ea1a939bacc1a17b6c6c2914eea6adadc5e4f77

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 4864	3012	rundll32.exe	79
PID 3012 wrote to memory of 4864	3012	rundll32.exe	79
PID 3012 wrote to memory of 4864	3012	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4605cd7bb40fb861d195dabcc9c78c6013555be693569dc655e54589a52a3e86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4605cd7bb40fb861d195dabcc9c78c6013555be693569dc655e54589a52a3e86.dll,#1
  2⤵
  PID:4864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads