5537e2cb1fc20798964872518e4d8eded7f85f28b9e59b3ccfdbcbe9e27c91d1 | Triage

Analysis

max time kernel
142s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 11:56

Sharing

Report Analysis Logs

General

Target

5537e2cb1fc20798964872518e4d8eded7f85f28b9e59b3ccfdbcbe9e27c91d1.dll
Size

3KB
MD5

affeec6461f6443001937144c3d65190
SHA1

2a840e2951b4a9ca3dc58e51f2f45d1c221c807d
SHA256

5537e2cb1fc20798964872518e4d8eded7f85f28b9e59b3ccfdbcbe9e27c91d1
SHA512

ede30ee4cf66b3041ccdc041864baad77328ead92ac02324ba72c7e458536cee3541c9eb775505403bcea33f7654bb4618e3cf996334d66cd99e35c78cf7b814

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 1656	5092	rundll32.exe	80
PID 5092 wrote to memory of 1656	5092	rundll32.exe	80
PID 5092 wrote to memory of 1656	5092	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5537e2cb1fc20798964872518e4d8eded7f85f28b9e59b3ccfdbcbe9e27c91d1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5537e2cb1fc20798964872518e4d8eded7f85f28b9e59b3ccfdbcbe9e27c91d1.dll,#1
  2⤵
  PID:1656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads