5690751f95eaedfa3752362176c6f2886ca05153c837634d4d04e4452c92a82e | Triage

Analysis

max time kernel
156s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 01:30

Sharing

Report Analysis Logs

General

Target

5690751f95eaedfa3752362176c6f2886ca05153c837634d4d04e4452c92a82e.dll
Size

3KB
MD5

8a9ea7004836fb63e7a1033306bd09f0
SHA1

9ab789bab08df7ea9357e178c7477524867519c2
SHA256

5690751f95eaedfa3752362176c6f2886ca05153c837634d4d04e4452c92a82e
SHA512

b51b045fab720688612e34862269992ebdbccbd5dfe29401f8b62caf4029b561b10c1d0239f0fadc5df2a15804c033081c03e4fed9cdfe23f47fb53ac6840ee7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 3868	1392	rundll32.exe	82
PID 1392 wrote to memory of 3868	1392	rundll32.exe	82
PID 1392 wrote to memory of 3868	1392	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5690751f95eaedfa3752362176c6f2886ca05153c837634d4d04e4452c92a82e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5690751f95eaedfa3752362176c6f2886ca05153c837634d4d04e4452c92a82e.dll,#1
  2⤵
  PID:3868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads