56d08f45ed24b0ffd6514f5c5008099f2569a9f2d54986a185cbe5718464730f | Triage

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 01:38

Sharing

Report Analysis Logs

General

Target

56d08f45ed24b0ffd6514f5c5008099f2569a9f2d54986a185cbe5718464730f.dll
Size

3KB
MD5

7ac17d1fc47ad4dad03cf59e5ff93b70
SHA1

4832a657d4448ec58cd9389e9ae59982d5312128
SHA256

56d08f45ed24b0ffd6514f5c5008099f2569a9f2d54986a185cbe5718464730f
SHA512

21f3e0f3e818f3ce5395ce63616044042432b9dcfa1011966c491490078d348b61cfcd68bf67b7d460ca4319e2ef1aad656285c21d978937af35b04c01189e77

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 3108	1264	rundll32.exe	81
PID 1264 wrote to memory of 3108	1264	rundll32.exe	81
PID 1264 wrote to memory of 3108	1264	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\56d08f45ed24b0ffd6514f5c5008099f2569a9f2d54986a185cbe5718464730f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\56d08f45ed24b0ffd6514f5c5008099f2569a9f2d54986a185cbe5718464730f.dll,#1
  2⤵
  PID:3108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads