9ca041ead868cba15ade72b18f6d7b15d98a1b5dcc6cd563bc6555b50d69dc14 | Triage

Analysis

max time kernel
91s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 11:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9ca041ead868cba15ade72b18f6d7b15d98a1b5dcc6cd563bc6555b50d69dc14.dll
Size

4KB
MD5

20b1ac8519c94a08e82635382b9d3010
SHA1

3e20afca6a299a255c1af0c18650affb2b378750
SHA256

9ca041ead868cba15ade72b18f6d7b15d98a1b5dcc6cd563bc6555b50d69dc14
SHA512

08c7795a3dcf2bfd5ecb7223e5dc251fcc97026fd67e4cf31a4b7934f2ab1d9330be28210dab52127a7680b02e93ec4574bafd4a04f29862896f8446ee4e5ed1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 4008	4828	rundll32.exe	81
PID 4828 wrote to memory of 4008	4828	rundll32.exe	81
PID 4828 wrote to memory of 4008	4828	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ca041ead868cba15ade72b18f6d7b15d98a1b5dcc6cd563bc6555b50d69dc14.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ca041ead868cba15ade72b18f6d7b15d98a1b5dcc6cd563bc6555b50d69dc14.dll,#1
  2⤵
  PID:4008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads