2e18baa108c1ac84540499f53b0470bf34acac6a93a6f5aca693c38969894079 | Triage

Analysis

max time kernel
156s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 15:19

Sharing

Report Analysis Logs

General

Target

2e18baa108c1ac84540499f53b0470bf34acac6a93a6f5aca693c38969894079.dll
Size

960B
MD5

52d36358b7072ac406eb81090f606460
SHA1

be6c281fe3d758d55883deb383bf73ae708c4b1c
SHA256

2e18baa108c1ac84540499f53b0470bf34acac6a93a6f5aca693c38969894079
SHA512

854441088cbf14ddac1ef50546da8d571c9fdfb83a968fb1aa4f7fab45ed6a6be58e8c6baf1c787770e99dbc66bcb0fc11840d416910fdf3c5c56a752508d061

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 4640	4636	rundll32.exe	80
PID 4636 wrote to memory of 4640	4636	rundll32.exe	80
PID 4636 wrote to memory of 4640	4636	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e18baa108c1ac84540499f53b0470bf34acac6a93a6f5aca693c38969894079.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e18baa108c1ac84540499f53b0470bf34acac6a93a6f5aca693c38969894079.dll,#1
  2⤵
  PID:4640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads