78848ecbc201d7186de2db11a95b8cbd7509791196034b74f0118c77c1451e79 | Triage

Analysis

max time kernel
138s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 01:22

Sharing

Report Analysis Logs

General

Target

78848ecbc201d7186de2db11a95b8cbd7509791196034b74f0118c77c1451e79.dll
Size

3KB
MD5

c80075cdadd83a0f6b8959b51e659090
SHA1

f0a8014ad0c35e2087eff55001a2b57dcaff80ad
SHA256

78848ecbc201d7186de2db11a95b8cbd7509791196034b74f0118c77c1451e79
SHA512

26260bb1305e7ddfc51266727dd9ae0b4757fff42f36bab999dfcc33caf65a1b84e5fcf31062f61e89c1925637b581b67f4a48d283bf5e039e6a1e0484c36b78

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 5072	1496	rundll32.exe	79
PID 1496 wrote to memory of 5072	1496	rundll32.exe	79
PID 1496 wrote to memory of 5072	1496	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78848ecbc201d7186de2db11a95b8cbd7509791196034b74f0118c77c1451e79.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\78848ecbc201d7186de2db11a95b8cbd7509791196034b74f0118c77c1451e79.dll,#1
  2⤵
  PID:5072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads