ac51558d7ed38b08f91d2f1ce0573a1153a1666cb3584fb1bd38c4b842f05404 | Triage

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 11:52

Sharing

Report Analysis Logs

General

Target

ac51558d7ed38b08f91d2f1ce0573a1153a1666cb3584fb1bd38c4b842f05404.dll
Size

3KB
MD5

a83a9a34344f9edf4d517d4207a29bc0
SHA1

2959ff16428ea9ba75f6744745d61afe9f63a0f1
SHA256

ac51558d7ed38b08f91d2f1ce0573a1153a1666cb3584fb1bd38c4b842f05404
SHA512

56860584f49b7ba9c441d135f5acd729fbe9bd0e86873754eb77076a04c7e9135f9426fbc471179d1bbe2addf1bd134816e337aab8f0b1654c4e6fff12d4ddfa

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 2072	4460	rundll32.exe	82
PID 4460 wrote to memory of 2072	4460	rundll32.exe	82
PID 4460 wrote to memory of 2072	4460	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac51558d7ed38b08f91d2f1ce0573a1153a1666cb3584fb1bd38c4b842f05404.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac51558d7ed38b08f91d2f1ce0573a1153a1666cb3584fb1bd38c4b842f05404.dll,#1
  2⤵
  PID:2072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads