6a729011f648949eee03cf4f012fd23515371588374d15d4da779160c6e8273b | Triage

Analysis

max time kernel
230s
max time network
224s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 01:38

Sharing

Report Analysis Logs

General

Target

6a729011f648949eee03cf4f012fd23515371588374d15d4da779160c6e8273b.dll
Size

3KB
MD5

0eca833fe06399ebfb9f8a215a4f43f0
SHA1

9036bfc0dd65bbe7f4aa50a74600a15171d33168
SHA256

6a729011f648949eee03cf4f012fd23515371588374d15d4da779160c6e8273b
SHA512

33bc8f9fada6ad56157f5dfb28e06911fdd2e9a9d7ce4e5b527ad7917820e95d7a6164eb64eeb08348c45dbebc479d8afb6e97eca56cc8ca8a6a81d0281ee339

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1620	2532	rundll32.exe	81
PID 2532 wrote to memory of 1620	2532	rundll32.exe	81
PID 2532 wrote to memory of 1620	2532	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a729011f648949eee03cf4f012fd23515371588374d15d4da779160c6e8273b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a729011f648949eee03cf4f012fd23515371588374d15d4da779160c6e8273b.dll,#1
  2⤵
  PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads