761523b0dc13f2507e072a10371fd18bc1dbbd9ee0805b0ced85b643ab5ce375 | Triage

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 13:34

Sharing

Report Analysis Logs

General

Target

761523b0dc13f2507e072a10371fd18bc1dbbd9ee0805b0ced85b643ab5ce375.dll
Size

4KB
MD5

d53b8124490ff11b33b352019cace820
SHA1

de12f2b8f3a74c3f5b907befbc02589fa19eec40
SHA256

761523b0dc13f2507e072a10371fd18bc1dbbd9ee0805b0ced85b643ab5ce375
SHA512

640d279b5199f9bb42dc59ae1df8e6e1777234401f103e976bb12dc0799722ca7df90e8659c912c1344b2f9ea885566d0c2cc2ddd850ec046bc1d2e8b310dc76

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 4932	4864	rundll32.exe	46
PID 4864 wrote to memory of 4932	4864	rundll32.exe	46
PID 4864 wrote to memory of 4932	4864	rundll32.exe	46

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\761523b0dc13f2507e072a10371fd18bc1dbbd9ee0805b0ced85b643ab5ce375.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\761523b0dc13f2507e072a10371fd18bc1dbbd9ee0805b0ced85b643ab5ce375.dll,#1
  2⤵
  PID:4932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads