cf22dfd2d88315b9dc292eb0d8f9c87cdf7a422cdd28c5a39361f36fa38a5ab4 | Triage

Resubmissions

01-08-2022 11:35

220801-np1bxafgh7 10

04-04-2022 16:05

220404-tj1y5sghf4 10

Analysis

max time kernel
129s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
04-04-2022 16:05

Sharing

Report Analysis Logs

General

Target

cf22dfd2d88315b9dc292eb0d8f9c87cdf7a422cdd28c5a39361f36fa38a5ab4.dll
Size

1.2MB
MD5

01093c63363ec6be6dbceaf560907f7e
SHA1

0330c617d7b1a66eb9912c775a23dd1efc0f125a
SHA256

cf22dfd2d88315b9dc292eb0d8f9c87cdf7a422cdd28c5a39361f36fa38a5ab4
SHA512

67c62fa97096051e72869208676b9c0a97026d02095212866b9a04bba42acc3f98d970fed7c76266d2c6d73885d2a954cdd5747cd109dd3cfbc3692cc3168a57

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

6 3984 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 792 wrote to memory of 3984	792	rundll32.exe	rundll32.exe
PID 792 wrote to memory of 3984	792	rundll32.exe	rundll32.exe
PID 792 wrote to memory of 3984	792	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf22dfd2d88315b9dc292eb0d8f9c87cdf7a422cdd28c5a39361f36fa38a5ab4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:792

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf22dfd2d88315b9dc292eb0d8f9c87cdf7a422cdd28c5a39361f36fa38a5ab4.dll,#1
2⤵
- Blocklisted process makes network request
PID:3984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3984-124-0x0000000000000000-mapping.dmp

Download