605de1ca98348e4a5234f036a90023b1440f33e5fc5132b54e036c560fad7e4c | Triage

Analysis

max time kernel
147s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 20:45

Sharing

Report Analysis Logs

General

Target

605de1ca98348e4a5234f036a90023b1440f33e5fc5132b54e036c560fad7e4c.dll
Size

3KB
MD5

8971ab83132b70d0ab78dd0370260d0d
SHA1

c192828bda44d0c17a546ae570692a9fd3251f8b
SHA256

605de1ca98348e4a5234f036a90023b1440f33e5fc5132b54e036c560fad7e4c
SHA512

f232a2f8cf95a3b10151913bc1811a31b4e4caadb54ba59d18a3c0ba66da816d21ccd3127414a470ad98d25454671c9c8a6fd7a26448a86c2764ba3c378fa47a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 1276	4980	rundll32.exe	82
PID 4980 wrote to memory of 1276	4980	rundll32.exe	82
PID 4980 wrote to memory of 1276	4980	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\605de1ca98348e4a5234f036a90023b1440f33e5fc5132b54e036c560fad7e4c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\605de1ca98348e4a5234f036a90023b1440f33e5fc5132b54e036c560fad7e4c.dll,#1
  2⤵
  PID:1276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads