ffc3a0458a0c56b922159ffcb6f8a33f98248ade104a4ce5609ee3dfe4ca56ec | Triage

Analysis

max time kernel
145s
max time network
148s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 00:38

Sharing

Report Analysis Logs

General

Target

ffc3a0458a0c56b922159ffcb6f8a33f98248ade104a4ce5609ee3dfe4ca56ec.dll
Size

164KB
MD5

aacf8de664d76b4624c72ce6daf2bc1a
SHA1

c20707d230c4916e3e227364e7a556d76379f23d
SHA256

ffc3a0458a0c56b922159ffcb6f8a33f98248ade104a4ce5609ee3dfe4ca56ec
SHA512

000a44c7f990d4314dbccdff3390d734a6a748d5199d39208d8c6eb95f7e6d80b17e1022bfdb35871c3a5cc05405db968b4e2e979d08e47d1095fc8ec44fb3d3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2728 wrote to memory of 3052	2728	rundll32.exe	rundll32.exe
PID 2728 wrote to memory of 3052	2728	rundll32.exe	rundll32.exe
PID 2728 wrote to memory of 3052	2728	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffc3a0458a0c56b922159ffcb6f8a33f98248ade104a4ce5609ee3dfe4ca56ec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2728

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffc3a0458a0c56b922159ffcb6f8a33f98248ade104a4ce5609ee3dfe4ca56ec.dll,#1
2⤵
PID:3052

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...