f9743bebdf5ebea790449b3bb013406c7a5943e0441b24d7badd8e0a20334fac | Triage

Analysis

max time kernel
141s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 11:48

Sharing

Report Analysis Logs

General

Target

f9743bebdf5ebea790449b3bb013406c7a5943e0441b24d7badd8e0a20334fac.dll
Size

4KB
MD5

7b9b7fed421e9f44581d251843bab100
SHA1

db5a599220311f4b8873c4832550c472bf757c01
SHA256

f9743bebdf5ebea790449b3bb013406c7a5943e0441b24d7badd8e0a20334fac
SHA512

a49c7601592981ccadda57d94cdb017c301e701b472c5d7083788c4f1cddcc50138e92d61e453dfa5d14d8ab5c037b453633112447e0ccdbe59ba5d2695ffa8d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 1360	4544	rundll32.exe	80
PID 4544 wrote to memory of 1360	4544	rundll32.exe	80
PID 4544 wrote to memory of 1360	4544	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9743bebdf5ebea790449b3bb013406c7a5943e0441b24d7badd8e0a20334fac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9743bebdf5ebea790449b3bb013406c7a5943e0441b24d7badd8e0a20334fac.dll,#1
  2⤵
  PID:1360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1360-132-0x0000000000000000-mapping.dmp

Download