0dbea4991827715a3a92d7f95fe59fee66cd31a7e0e33ed393972e1f315bc335 | Triage

Analysis

max time kernel
91s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 11:39

Sharing

Report Analysis Logs

General

Target

0dbea4991827715a3a92d7f95fe59fee66cd31a7e0e33ed393972e1f315bc335.dll
Size

4KB
MD5

5bd2c8a69e6aec3e2970ce71de3c1570
SHA1

caae30ada04e7e1ef641b9250b0337caf0526a3c
SHA256

0dbea4991827715a3a92d7f95fe59fee66cd31a7e0e33ed393972e1f315bc335
SHA512

ccf190a050152d0ef52b49a8782088b3485b3f901925ca733dbefafdb2c922c35ead13686ebc0bc3914d3ba5fd1cb8cacf2845eea51ef5a9420886a0e83b602b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2524	1628	rundll32.exe	81
PID 1628 wrote to memory of 2524	1628	rundll32.exe	81
PID 1628 wrote to memory of 2524	1628	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0dbea4991827715a3a92d7f95fe59fee66cd31a7e0e33ed393972e1f315bc335.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0dbea4991827715a3a92d7f95fe59fee66cd31a7e0e33ed393972e1f315bc335.dll,#1
  2⤵
  PID:2524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2524-132-0x0000000000000000-mapping.dmp

Download