a1a5f09d5c074fb31b02f30a59e922962dbdd6067c059df8dba4fbc1bc80f541 | Triage

Analysis

max time kernel
70s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 20:44

Sharing

Report Analysis Logs

General

Target

a1a5f09d5c074fb31b02f30a59e922962dbdd6067c059df8dba4fbc1bc80f541.dll
Size

3KB
MD5

4e35c414861b02551373de25e909220a
SHA1

080d9f1778efe7d47b0a193611f973afb273770f
SHA256

a1a5f09d5c074fb31b02f30a59e922962dbdd6067c059df8dba4fbc1bc80f541
SHA512

a5a701319ec8a4591980c28b10810d55e7e7be4486117257b5efa33433271d833fd7a11adc13910a28cb17bbc18dcd6816326f2c9c3e6c764967ac3299fc5fc7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2444	1752	rundll32.exe	79
PID 1752 wrote to memory of 2444	1752	rundll32.exe	79
PID 1752 wrote to memory of 2444	1752	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1a5f09d5c074fb31b02f30a59e922962dbdd6067c059df8dba4fbc1bc80f541.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1a5f09d5c074fb31b02f30a59e922962dbdd6067c059df8dba4fbc1bc80f541.dll,#1
  2⤵
  PID:2444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2444-132-0x0000000000000000-mapping.dmp

Download