875af997be51a8e832a99dffb3f2b9c2fe6df42e7a51726ae76164bcc0df120a | Triage

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 20:38

Sharing

Report Analysis Logs

General

Target

875af997be51a8e832a99dffb3f2b9c2fe6df42e7a51726ae76164bcc0df120a.dll
Size

3KB
MD5

287b1b6ac82f4cf98d338ddcdef9af80
SHA1

db62d341df1f45df95afccbbc69772420526cf78
SHA256

875af997be51a8e832a99dffb3f2b9c2fe6df42e7a51726ae76164bcc0df120a
SHA512

bcc8e96d2868658f3358a9afac211d95900debf0a8677b47e58f4d69234e3c7c38f30c8d23f6f474ef421dbb3c2ea079a72861fef4029d50751a2e98fe82d096

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 4680	4416	rundll32.exe	80
PID 4416 wrote to memory of 4680	4416	rundll32.exe	80
PID 4416 wrote to memory of 4680	4416	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\875af997be51a8e832a99dffb3f2b9c2fe6df42e7a51726ae76164bcc0df120a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\875af997be51a8e832a99dffb3f2b9c2fe6df42e7a51726ae76164bcc0df120a.dll,#1
  2⤵
  PID:4680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads