a3c89fabb30ace4a4716eeda6b3de5e46f3c97cb93d7d13925928985d15b0fd9 | Triage

Analysis

max time kernel
139s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 20:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a3c89fabb30ace4a4716eeda6b3de5e46f3c97cb93d7d13925928985d15b0fd9.dll
Size

3KB
MD5

f3b422ecd5e770ea2dbf655f34b842ee
SHA1

8b239448c30d8d4c8cff27b36204560d64306154
SHA256

a3c89fabb30ace4a4716eeda6b3de5e46f3c97cb93d7d13925928985d15b0fd9
SHA512

ebd9fc4f8130b3d12f40578713adb694680d07ee10bcb79df5c7c2497cd50057e4e5262361712953f71edfad767d66c284ff2a81445e39284f508317e4e6a174

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 4900	2348	rundll32.exe	79
PID 2348 wrote to memory of 4900	2348	rundll32.exe	79
PID 2348 wrote to memory of 4900	2348	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3c89fabb30ace4a4716eeda6b3de5e46f3c97cb93d7d13925928985d15b0fd9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3c89fabb30ace4a4716eeda6b3de5e46f3c97cb93d7d13925928985d15b0fd9.dll,#1
  2⤵
  PID:4900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads