80603a325abea64fdeb72d223826b5baeacb68e9b1cfac34c1fec555565b891e | Triage

Analysis

max time kernel
133s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:00

Sharing

Report Analysis Logs

General

Target

80603a325abea64fdeb72d223826b5baeacb68e9b1cfac34c1fec555565b891e.dll
Size

4KB
MD5

d6ddd9e435212a5703defd58ba549747
SHA1

1dd8700ff9c87868ac88e62ba522cb1bb6c3fb7c
SHA256

80603a325abea64fdeb72d223826b5baeacb68e9b1cfac34c1fec555565b891e
SHA512

5063e1d0ac1a8f8db2b0ed2c74b4de1f4b06505bf55039609ab0b6438140a446f17c4ef20da13b83fb9bf4c27d26930a0cdce9f9e0b9c42f6a58493bc16e36b1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3252 wrote to memory of 1900	3252	rundll32.exe	rundll32.exe
PID 3252 wrote to memory of 1900	3252	rundll32.exe	rundll32.exe
PID 3252 wrote to memory of 1900	3252	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\80603a325abea64fdeb72d223826b5baeacb68e9b1cfac34c1fec555565b891e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3252

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\80603a325abea64fdeb72d223826b5baeacb68e9b1cfac34c1fec555565b891e.dll,#1
2⤵
PID:1900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads