acd0d31e78f9e9434aa664a79b23f50f17664784f0c6f6e6e8ddd987767393b1 | Triage

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 11:52

Sharing

Report Analysis Logs

General

Target

acd0d31e78f9e9434aa664a79b23f50f17664784f0c6f6e6e8ddd987767393b1.dll
Size

3KB
MD5

236c4636b38a80c3e9403feb2f6362e0
SHA1

5c29652d424d5ece5bb4c54773ac69df5b2b83da
SHA256

acd0d31e78f9e9434aa664a79b23f50f17664784f0c6f6e6e8ddd987767393b1
SHA512

c036f960ea7629663b9d76b24e5334bb4e81c43c2f7b30196e24f07d999876b5a893f707ad51c6779235c04a6168ffe28a397988711af4774af02236eee64683

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 1848	3284	rundll32.exe	64
PID 3284 wrote to memory of 1848	3284	rundll32.exe	64
PID 3284 wrote to memory of 1848	3284	rundll32.exe	64

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\acd0d31e78f9e9434aa664a79b23f50f17664784f0c6f6e6e8ddd987767393b1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\acd0d31e78f9e9434aa664a79b23f50f17664784f0c6f6e6e8ddd987767393b1.dll,#1
  2⤵
  PID:1848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads