b16cfd9f3059a80404036d9d4851be86989433cdeecc21639372439be9cc7210 | Triage

Analysis

max time kernel
185s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 01:09

Sharing

Report Analysis Logs

General

Target

b16cfd9f3059a80404036d9d4851be86989433cdeecc21639372439be9cc7210.dll
Size

4KB
MD5

ec6000a8f1b5b2ed1492fbf94b680d60
SHA1

cf4c7cf4a8b75d3829cc97c0759b2f44ab2125cc
SHA256

b16cfd9f3059a80404036d9d4851be86989433cdeecc21639372439be9cc7210
SHA512

cddb7c767b58a50cd8fe1762cc5ca4529fe2c7e9332e61f5e585fc954f2385b3f7ca8bca0569f83a878d257e47b974b134ad83ac4370c38b0b9cbf41a806fc44

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1676	2420	rundll32.exe	83
PID 2420 wrote to memory of 1676	2420	rundll32.exe	83
PID 2420 wrote to memory of 1676	2420	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b16cfd9f3059a80404036d9d4851be86989433cdeecc21639372439be9cc7210.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b16cfd9f3059a80404036d9d4851be86989433cdeecc21639372439be9cc7210.dll,#1
  2⤵
  PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1676-132-0x0000000000000000-mapping.dmp

Download