dcedf234c0f9d6fe3a4392693c82708c70c8e243f42f2e7073d35bd928f3b526

Analysis

max time kernel
150s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
09/03/2022, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e712dec65bd1bd4d6ca416a319ca231a.exe
Size 1.2MB
Sample220309-pmq6wsbccq
SHA256 dcedf234c0f9d6fe3a4392693c82708c70c8e243f42f2e7073d35bd928f3b526
MD5 e712dec65bd1bd4d6ca416a319ca231a
SHA1 5681829d6b0d529c62609c15304286fd357410d7
SHA512 11528cce75c43e2c79160ca9bb8c9371972e40917bf3d7a1fbb17d800d9aa46e50d7df6709cadaa2c01434469d998e92dd8057d8dd0e7c56d65fac079dbf2d70
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
32	3348	rundll32.exe
45	3348	rundll32.exe
48	3348	rundll32.exe
50	3348	rundll32.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 3348	2952	e712dec65bd1bd4d6ca416a319ca231a.exe	58
PID 2952 wrote to memory of 3348	2952	e712dec65bd1bd4d6ca416a319ca231a.exe	58
PID 2952 wrote to memory of 3348	2952	e712dec65bd1bd4d6ca416a319ca231a.exe	58
PID 2952 wrote to memory of 3348	2952	e712dec65bd1bd4d6ca416a319ca231a.exe	58
PID 2952 wrote to memory of 3348	2952	e712dec65bd1bd4d6ca416a319ca231a.exe	58
PID 2952 wrote to memory of 3348	2952	e712dec65bd1bd4d6ca416a319ca231a.exe	58
PID 2952 wrote to memory of 3348	2952	e712dec65bd1bd4d6ca416a319ca231a.exe	58
PID 2952 wrote to memory of 3348	2952	e712dec65bd1bd4d6ca416a319ca231a.exe	58
PID 2952 wrote to memory of 3348	2952	e712dec65bd1bd4d6ca416a319ca231a.exe	58
PID 2952 wrote to memory of 3348	2952	e712dec65bd1bd4d6ca416a319ca231a.exe	58
PID 2952 wrote to memory of 3348	2952	e712dec65bd1bd4d6ca416a319ca231a.exe	58
PID 2952 wrote to memory of 3348	2952	e712dec65bd1bd4d6ca416a319ca231a.exe	58
PID 2952 wrote to memory of 3348	2952	e712dec65bd1bd4d6ca416a319ca231a.exe	58
PID 2952 wrote to memory of 3348	2952	e712dec65bd1bd4d6ca416a319ca231a.exe	58
PID 2952 wrote to memory of 3348	2952	e712dec65bd1bd4d6ca416a319ca231a.exe	58
PID 2952 wrote to memory of 3348	2952	e712dec65bd1bd4d6ca416a319ca231a.exe	58
PID 2952 wrote to memory of 3348	2952	e712dec65bd1bd4d6ca416a319ca231a.exe	58
PID 2952 wrote to memory of 3348	2952	e712dec65bd1bd4d6ca416a319ca231a.exe	58
PID 2952 wrote to memory of 3348	2952	e712dec65bd1bd4d6ca416a319ca231a.exe	58

C:\Users\Admin\AppData\Local\Temp\e712dec65bd1bd4d6ca416a319ca231a.exe
"C:\Users\Admin\AppData\Local\Temp\e712dec65bd1bd4d6ca416a319ca231a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  - Blocklisted process makes network request
  PID:3348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2952 -ip 2952
1⤵
PID:1460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2952-130-0x0000000004C1C000-0x0000000004CFD000-memory.dmp

Download

memory/2952-131-0x0000000004D80000-0x0000000004FAD000-memory.dmp

Download

memory/2952-132-0x0000000000400000-0x0000000002F64000-memory.dmp

Download

memory/2952-133-0x0000000000400000-0x0000000002F64000-memory.dmp

Download

memory/2952-134-0x0000000000400000-0x0000000002F64000-memory.dmp

Download

memory/2952-135-0x00000000770F0000-0x0000000077293000-memory.dmp

Download

memory/3348-136-0x0000000003050000-0x0000000003053000-memory.dmp

Download

memory/3348-137-0x00000000770F0000-0x0000000077293000-memory.dmp

Download

memory/3348-138-0x00000000763C0000-0x0000000076560000-memory.dmp

Download

memory/3348-140-0x0000000003070000-0x0000000003073000-memory.dmp

Download

memory/3348-139-0x0000000003060000-0x0000000003063000-memory.dmp

Download

memory/3348-141-0x0000000003080000-0x0000000003083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads