9ae5bfe2cb2131eba508b3ea11c7dccdac3464a0393146d54226787a671d7b71 | Triage

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 09:18

Sharing

Report Analysis Logs

General

Target

9ae5bfe2cb2131eba508b3ea11c7dccdac3464a0393146d54226787a671d7b71.dll
Size

3KB
MD5

391d4bdd94307e8c53aac13064a8fa70
SHA1

40203788a4b48808ce78a41c71c270b84c9e40f7
SHA256

9ae5bfe2cb2131eba508b3ea11c7dccdac3464a0393146d54226787a671d7b71
SHA512

8e385bbf48082f7242b24cf6d9e4e6f245f5fc04810d78ed4a4757cc664f0d7a1e165cb138c6174dcdcb834177b2cbb6bc8531955b7c35a8ea112d5c634952f1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1292	1636	rundll32.exe	82
PID 1636 wrote to memory of 1292	1636	rundll32.exe	82
PID 1636 wrote to memory of 1292	1636	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ae5bfe2cb2131eba508b3ea11c7dccdac3464a0393146d54226787a671d7b71.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ae5bfe2cb2131eba508b3ea11c7dccdac3464a0393146d54226787a671d7b71.dll,#1
  2⤵
  PID:1292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads