df00ad172e6d50680ea5fcee2afdb7b2aaa6ab4f5fa5bd735cc38e9c3edf2d99 | Triage

Analysis

max time kernel
162s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 20:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

df00ad172e6d50680ea5fcee2afdb7b2aaa6ab4f5fa5bd735cc38e9c3edf2d99.dll
Size

3KB
MD5

44d23c78fb2e9352bb8000c9d2edd860
SHA1

c25da802cd5d35d6808ffbcd2b9b283a15bf7c3a
SHA256

df00ad172e6d50680ea5fcee2afdb7b2aaa6ab4f5fa5bd735cc38e9c3edf2d99
SHA512

2309ba3241bc78e8311ac476253d7038c219da63ce52905bb04397526f774f95767cbc86959f2e73ddbec9df04e5c1286d7be00beca9b3e324d8a4b3f63fb1b8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 208	4640	rundll32.exe	83
PID 4640 wrote to memory of 208	4640	rundll32.exe	83
PID 4640 wrote to memory of 208	4640	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\df00ad172e6d50680ea5fcee2afdb7b2aaa6ab4f5fa5bd735cc38e9c3edf2d99.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\df00ad172e6d50680ea5fcee2afdb7b2aaa6ab4f5fa5bd735cc38e9c3edf2d99.dll,#1
  2⤵
  PID:208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads