f352c5a50bd9731e4178ee590fbfbc154f61da150534fdb33bd5f667505181d1 | Triage

Analysis

max time kernel
15s
max time network
14s
platform
windows10_x64
resource
win10v20210408
submitted
22-04-2021 05:40

Sharing

Report Analysis Logs

General

Target

API-MS-Win-core-xstate-l2-1-0.dll
Size

19KB
MD5

4f50c180c41117cdce24eb15a989945c
SHA1

338ca08fab142f2e221975ad36e24622ff636dbb
SHA256

c251c228c2e5c551a4df1d06f123f475aa4a1c94350e46e50399f28a1a15e1cb
SHA512

11a39943cd2e66acf3c241cd5a03c164bb5f5e484075d6c6420cccead99d0b37b23d833e5995555f15e3d9ce977e388f56bea7210287abcfbe84f654acd992a7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4044 wrote to memory of 3708	4044	rundll32.exe	rundll32.exe
PID 4044 wrote to memory of 3708	4044	rundll32.exe	rundll32.exe
PID 4044 wrote to memory of 3708	4044	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\API-MS-Win-core-xstate-l2-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4044

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\API-MS-Win-core-xstate-l2-1-0.dll,#1
2⤵
PID:3708

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3708-114-0x0000000000000000-mapping.dmp

Download