d11fd191449c4adab01e017088bc2f767bafe417524159085e65c62ae05859ee | Triage

Analysis

max time kernel
138s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 20:35

Sharing

Report Analysis Logs

General

Target

d11fd191449c4adab01e017088bc2f767bafe417524159085e65c62ae05859ee.dll
Size

3KB
MD5

36ab0b2441dc64d01326e3a305cea764
SHA1

4574ab6471195d74829bfe06884dcbd0998c3615
SHA256

d11fd191449c4adab01e017088bc2f767bafe417524159085e65c62ae05859ee
SHA512

4d1840ec1a879607fcb97a4f873752c3ab6e60daffb9f17b3809e195ce3c5344ba3f07465388ef421cbebf91bf91bccd25a61116d75368f95224b90722b08e87

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 2172	4116	rundll32.exe	29
PID 4116 wrote to memory of 2172	4116	rundll32.exe	29
PID 4116 wrote to memory of 2172	4116	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d11fd191449c4adab01e017088bc2f767bafe417524159085e65c62ae05859ee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d11fd191449c4adab01e017088bc2f767bafe417524159085e65c62ae05859ee.dll,#1
  2⤵
  PID:2172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2172-132-0x0000000000000000-mapping.dmp

Download