023629a125b1874a992396f2c95805d869c81c5a07dc3b77ab91011dffc3aca4 | Triage

Analysis

max time kernel
256s
max time network
283s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 20:46

Sharing

Report Analysis Logs

General

Target

023629a125b1874a992396f2c95805d869c81c5a07dc3b77ab91011dffc3aca4.dll
Size

3KB
MD5

f2b44ab9930f041dc7f2845dc89b71a0
SHA1

9f6174959a7c76dc44be5f04dd67fe5f3538482c
SHA256

023629a125b1874a992396f2c95805d869c81c5a07dc3b77ab91011dffc3aca4
SHA512

daf96f0eec3c61bf2c5f2bf396f967a7ef33d02707479ef20e9c2f78093a9c817a6ea5f79c9fd83047453721362d30d09343f287895e9ec6ed150f8ed52e7c86

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 3720	3440	rundll32.exe	33
PID 3440 wrote to memory of 3720	3440	rundll32.exe	33
PID 3440 wrote to memory of 3720	3440	rundll32.exe	33

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\023629a125b1874a992396f2c95805d869c81c5a07dc3b77ab91011dffc3aca4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\023629a125b1874a992396f2c95805d869c81c5a07dc3b77ab91011dffc3aca4.dll,#1
  2⤵
  PID:3720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads