859e96922b5789184b7315f3364ea39315a2b1b84570d67a22b05f98cd3da2c9 | Triage

Analysis

max time kernel
188s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 11:32

Sharing

Report Analysis Logs

General

Target

859e96922b5789184b7315f3364ea39315a2b1b84570d67a22b05f98cd3da2c9.dll
Size

4KB
MD5

4001fd93bab49e2b4a4c0d56a6c5d8c0
SHA1

53bdb807d9f573ae72f4716171b45cb37bcb12f5
SHA256

859e96922b5789184b7315f3364ea39315a2b1b84570d67a22b05f98cd3da2c9
SHA512

ac5738cd03e77902722cfd7ce9b9007ab0f08a216d948d0ec944d1a820ff085c2d51bbbf42323818dea444f73b031e29f24cc38f3d731f59f6390306437d3c36

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1204	1344	rundll32.exe	84
PID 1344 wrote to memory of 1204	1344	rundll32.exe	84
PID 1344 wrote to memory of 1204	1344	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\859e96922b5789184b7315f3364ea39315a2b1b84570d67a22b05f98cd3da2c9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\859e96922b5789184b7315f3364ea39315a2b1b84570d67a22b05f98cd3da2c9.dll,#1
  2⤵
  PID:1204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads