b2942d28b0ed977020b20291aff53c8bfec152d8511392fcbe56e49afe001926 | Triage

Analysis

max time kernel
174s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 20:36

Sharing

Report Analysis Logs

General

Target

b2942d28b0ed977020b20291aff53c8bfec152d8511392fcbe56e49afe001926.dll
Size

3KB
MD5

39f9cd1ecfaa70d935eaba86e6fbe42f
SHA1

ba32fd3699174cf2870249370e0baca0ea43f390
SHA256

b2942d28b0ed977020b20291aff53c8bfec152d8511392fcbe56e49afe001926
SHA512

37b212b1e8814835244023fb4a3d62c27545da860171be347daadf2acf94b201b5668a6f994c006ed18f6f30201be5baee86cf78c324794449568c763abd6c42

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 2432	4824	rundll32.exe	82
PID 4824 wrote to memory of 2432	4824	rundll32.exe	82
PID 4824 wrote to memory of 2432	4824	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2942d28b0ed977020b20291aff53c8bfec152d8511392fcbe56e49afe001926.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2942d28b0ed977020b20291aff53c8bfec152d8511392fcbe56e49afe001926.dll,#1
  2⤵
  PID:2432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads