8faf664a4c9a7baa22c15cfdb641ecfa412f67367ab3ee3e996cd921ca8d0f72 | Triage

Analysis

max time kernel
14s
max time network
3s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 11:51

Sharing

Report Analysis Logs

General

Target

8faf664a4c9a7baa22c15cfdb641ecfa412f67367ab3ee3e996cd921ca8d0f72.dll
Size

3KB
MD5

92a9c28532b18ae678c7949840d780d0
SHA1

fb2f87018fbb2fe7c2ba8b804307f900b87af2b1
SHA256

8faf664a4c9a7baa22c15cfdb641ecfa412f67367ab3ee3e996cd921ca8d0f72
SHA512

58e6e623e5bef79229a84b87aa61fa433fbce8e762c70e499296118f97f4e948b8e5eea30ca8943de4354c1e4130dcc2fcf7e162b09d1f51b3f390feb2d95b81

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1564	2228	rundll32.exe	75
PID 2228 wrote to memory of 1564	2228	rundll32.exe	75
PID 2228 wrote to memory of 1564	2228	rundll32.exe	75

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8faf664a4c9a7baa22c15cfdb641ecfa412f67367ab3ee3e996cd921ca8d0f72.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8faf664a4c9a7baa22c15cfdb641ecfa412f67367ab3ee3e996cd921ca8d0f72.dll,#1
  2⤵
  PID:1564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads