ceb597d3dd23506137e4db57aff6889e7cd8290eeed1301b416ef18827e8fdce | Triage

Analysis

max time kernel
138s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 20:36

Sharing

Report Analysis Logs

General

Target

ceb597d3dd23506137e4db57aff6889e7cd8290eeed1301b416ef18827e8fdce.dll
Size

3KB
MD5

f1e160b4ece3b5baff58edba07ff76a0
SHA1

4be29a18173fb76e1f01ca0b41b3e90a90cb8e64
SHA256

ceb597d3dd23506137e4db57aff6889e7cd8290eeed1301b416ef18827e8fdce
SHA512

e0eb935584560cee2ada7214086cb5cdb7a0c9196d939da4673c86ee60767e5440fc41748bb311cd62679198c5bb2abc4bb7bc4178af8c9114deb2d9654ab658

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 3676	4092	rundll32.exe	79
PID 4092 wrote to memory of 3676	4092	rundll32.exe	79
PID 4092 wrote to memory of 3676	4092	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ceb597d3dd23506137e4db57aff6889e7cd8290eeed1301b416ef18827e8fdce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ceb597d3dd23506137e4db57aff6889e7cd8290eeed1301b416ef18827e8fdce.dll,#1
  2⤵
  PID:3676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3676-132-0x0000000000000000-mapping.dmp

Download