029759c8d9f3eea27504883565bf6dfa961d4c366fc536ed68318d47d7e8f117 | Triage

Analysis

max time kernel
155s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
28-05-2022 03:46

Sharing

Report Analysis Logs

General

Target

029759c8d9f3eea27504883565bf6dfa961d4c366fc536ed68318d47d7e8f117.dll
Size

160KB
MD5

5c3ddf6babde5bb8653326f27636fa37
SHA1

1a51d7b6b65d5ef8c58ae2a09cbd8bf1ad35b97b
SHA256

029759c8d9f3eea27504883565bf6dfa961d4c366fc536ed68318d47d7e8f117
SHA512

bbe484c79f5221120eb22719223e58e116ed8336dfb75e624b64fbcfe136a231d478fc64cadeb869a5b007789f2feff42e41105f564382e480153ce36d429773

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 896 wrote to memory of 3396	896	rundll32.exe	rundll32.exe
PID 896 wrote to memory of 3396	896	rundll32.exe	rundll32.exe
PID 896 wrote to memory of 3396	896	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\029759c8d9f3eea27504883565bf6dfa961d4c366fc536ed68318d47d7e8f117.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:896

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\029759c8d9f3eea27504883565bf6dfa961d4c366fc536ed68318d47d7e8f117.dll,#1
2⤵
PID:3396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3396-130-0x0000000000000000-mapping.dmp

Download