404e73461105db62256d2a8009b53f99d32b29b5c1c2c805640732a6e29e8d06 | Triage

Analysis

max time kernel
112s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 11:43

Sharing

Report Analysis Logs

General

Target

404e73461105db62256d2a8009b53f99d32b29b5c1c2c805640732a6e29e8d06.dll
Size

3KB
MD5

ed0464c80c18cb51acbfe0b736609c40
SHA1

f588053000eaea190e03a09105096a9508442508
SHA256

404e73461105db62256d2a8009b53f99d32b29b5c1c2c805640732a6e29e8d06
SHA512

6aaef9551570ec98bfff8ed925418417610391e0fcbdf8050d296eeb734de3b6f25306f76f3efc1ab292edc7fe001a7df9d3ec4537abc2d79643ccfe5fdbfbbe

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 1724	4752	rundll32.exe	82
PID 4752 wrote to memory of 1724	4752	rundll32.exe	82
PID 4752 wrote to memory of 1724	4752	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\404e73461105db62256d2a8009b53f99d32b29b5c1c2c805640732a6e29e8d06.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\404e73461105db62256d2a8009b53f99d32b29b5c1c2c805640732a6e29e8d06.dll,#1
  2⤵
  PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-132-0x0000000000000000-mapping.dmp

Download