5eeee93264af8732438abac7e9b9c738b98024149238c4839384d2603265d6cc | Triage

Analysis

max time kernel
154s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5eeee93264af8732438abac7e9b9c738b98024149238c4839384d2603265d6cc.dll
Size

4KB
MD5

ca5f1d52aa473557b476838843bc6df0
SHA1

b68e58031a2c87387c3d4acbca669f0fde7daabe
SHA256

5eeee93264af8732438abac7e9b9c738b98024149238c4839384d2603265d6cc
SHA512

7a62e6267ac14b42b1dd3efa052a90f92c4039fa6db186915fd4c03dcc80518c4ab30815c4bbf6a1c17132d61654c473fe5c2290e361286a5d715652429ac85c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 4496	4696	rundll32.exe	78
PID 4696 wrote to memory of 4496	4696	rundll32.exe	78
PID 4696 wrote to memory of 4496	4696	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5eeee93264af8732438abac7e9b9c738b98024149238c4839384d2603265d6cc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5eeee93264af8732438abac7e9b9c738b98024149238c4839384d2603265d6cc.dll,#1
  2⤵
  PID:4496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads