33af9ecd4f11b66e3a1dc74477dd8614533eaea80d67fdda26cc948f7d693e2f | Triage

Analysis

max time kernel
2s
max time network
9s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
18-01-2022 13:38

Sharing

Report Analysis Logs

General

Target

1.dll
Size

645KB
MD5

8d24810baf00c916c460f650b3635908
SHA1

cb437477a87258436dadf1984fdb0569ce5921e5
SHA256

33af9ecd4f11b66e3a1dc74477dd8614533eaea80d67fdda26cc948f7d693e2f
SHA512

2e6520a7eedfc9ae3875bbd7b14e3959afa4e09ad06448a132d2aabcb102ae90aca3d66e7119530d63ba6e97371f67f72b7538f0ec41a50897e7b510f2f2b48b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3704 wrote to memory of 1152	3704	rundll32.exe	rundll32.exe
PID 3704 wrote to memory of 1152	3704	rundll32.exe	rundll32.exe
PID 3704 wrote to memory of 1152	3704	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3704

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1.dll,#1
2⤵
PID:1152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1152-130-0x00000000040A0000-0x0000000004140000-memory.dmp

Filesize
640KB

Download