0f507c30f6f8878a6536dc8c48caaa05a9027883be1746e71ec1dea5aedcf694 | Triage

Analysis

max time kernel
148s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 11:50

Sharing

Report Analysis Logs

General

Target

0f507c30f6f8878a6536dc8c48caaa05a9027883be1746e71ec1dea5aedcf694.dll
Size

4KB
MD5

d43ff470130e7c471db945e287ddcc50
SHA1

a87ed566dc08c81d434e1a3cbced5ac5a25fcb1a
SHA256

0f507c30f6f8878a6536dc8c48caaa05a9027883be1746e71ec1dea5aedcf694
SHA512

3815e28428cff199759ab40aceb90eadfe3c65383a77438317a355d8cad4decd86710c6137d702f42a6f2b8ca8ada571c06c830cd0d83945824844b9a533dcf7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 4256	5008	rundll32.exe	83
PID 5008 wrote to memory of 4256	5008	rundll32.exe	83
PID 5008 wrote to memory of 4256	5008	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f507c30f6f8878a6536dc8c48caaa05a9027883be1746e71ec1dea5aedcf694.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f507c30f6f8878a6536dc8c48caaa05a9027883be1746e71ec1dea5aedcf694.dll,#1
  2⤵
  PID:4256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads