a789b89f0da4794a2299e49e6dc1c1bf9d6790bcc9e1bb9cc87e77116715e7af | Triage™

Resubmissions

04/08/2022, 15:52

220804-ta325shfap

24/05/2022, 17:22

220524-vxll2sbac210

Analysis

max time kernel
114s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
24/05/2022, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lib1.dll
Size 394KB
Sample220524-vxll2sbac2
SHA256 e79f95d218aacbdcb35c4a843d999f8a642111fae72f7f20534c36a339580db0
MD5 00d8bba1b87c9ad7a19e843f17bd0398
SHA1 a1c70baaf38dc9641b7feb211d8cbedeae1f1908
SHA512 8513c2f0ccf88977cb1ea8ad2f97d5d73eb25ecc3fe061f56aa80a76fe4dd29e47601960007bc5fdc40a26225d260846443246e0a489f9fccb40d34291389ff7
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 3576	2224	rundll32.exe	16
PID 2224 wrote to memory of 3576	2224	rundll32.exe	16
PID 2224 wrote to memory of 3576	2224	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib1.dll,#1
  2⤵
  PID:3576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads