22ade24033280f21cafadeb7eec43e971a1dc161a2fd6d6c6b9f909c6f01d2df | Triage

Analysis

max time kernel
19s
max time network
113s
platform
windows10_x64
resource
win10v20201028
submitted
15-11-2020 22:36

Sharing

Report Analysis Logs

General

Target

22ade24033280f21cafadeb7eec43e971a1dc161a2fd6d6c6b9f909c6f01d2df.dll
Size

207KB
MD5

aa790158d499ccbd52bac2fbf415aa68
SHA1

8d25d860312787f611a3b700c267404167cb78e7
SHA256

22ade24033280f21cafadeb7eec43e971a1dc161a2fd6d6c6b9f909c6f01d2df
SHA512

7a16c1df96a213827e8761b8917d745765a64acbf74a253e0fc12ad8a2f598c61b83963effa6f111dd4589050a8cb792c0bf37dc7f79adc5bf6da5eec0151b0e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 984 wrote to memory of 1132	984	rundll32.exe	rundll32.exe
PID 984 wrote to memory of 1132	984	rundll32.exe	rundll32.exe
PID 984 wrote to memory of 1132	984	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\22ade24033280f21cafadeb7eec43e971a1dc161a2fd6d6c6b9f909c6f01d2df.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:984

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\22ade24033280f21cafadeb7eec43e971a1dc161a2fd6d6c6b9f909c6f01d2df.dll,#1
2⤵
PID:1132

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1132-0-0x0000000000000000-mapping.dmp

Download