0228591177e23efbc29ea9da223160ea2ac475be440a4c2ccef4263b40e8ad8d | Triage

Resubmissions

30-12-2021 05:18

211230-fzm6bsfee6 1

24-12-2021 11:10

211224-m9tt7achej 10

Analysis

max time kernel
119s
max time network
122s
platform
windows10_x64
resource
win10-en-20211208
submitted
30-12-2021 05:18

Sharing

Report Analysis Logs

General

Target

0228591177e23efbc29ea9da223160ea2ac475be440a4c2ccef4263b40e8ad8d.bin.dll
Size

5KB
MD5

1eccc0a6f16502e5f7fcb1f44e2225af
SHA1

0e8037b67d8444b1f4c46f598f8e62ba99e2b9fc
SHA256

0228591177e23efbc29ea9da223160ea2ac475be440a4c2ccef4263b40e8ad8d
SHA512

31e96d48b0f6a7ae6ea723dd3ad02dadbc237d15b61dd7ade5904fbfd22494d9d61266041a2f881128f9d439a0a873d09173e02d1104a3e89946710bec86f2b5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 652 wrote to memory of 2056	652	rundll32.exe	69
PID 652 wrote to memory of 2056	652	rundll32.exe	69
PID 652 wrote to memory of 2056	652	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0228591177e23efbc29ea9da223160ea2ac475be440a4c2ccef4263b40e8ad8d.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0228591177e23efbc29ea9da223160ea2ac475be440a4c2ccef4263b40e8ad8d.bin.dll,#1
  2⤵
  PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2056-115-0x0000000000000000-mapping.dmp

Download