07fe14af3cb2a2c6c8d86580111bf0471b57475159e5de07a17dcc812a1b9d79 | Triage

Analysis

max time kernel
149s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
30-05-2022 23:48

Sharing

Report Analysis Logs

General

Target

07fe14af3cb2a2c6c8d86580111bf0471b57475159e5de07a17dcc812a1b9d79.dll
Size

164KB
MD5

aad6aa0d64bf9a70e51a5357db81aeaf
SHA1

d32f5f8c343e96a4b407e1b24d93738d98f0bc90
SHA256

07fe14af3cb2a2c6c8d86580111bf0471b57475159e5de07a17dcc812a1b9d79
SHA512

047629759663a1ce2536f52ea0ab1210d43af8a857b4cc7d980420220f4736696aefadb15b8c31d80c82bb61f8d595fe16e59a26aa8827b301943208c4193a39

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3724 wrote to memory of 3656	3724	rundll32.exe	rundll32.exe
PID 3724 wrote to memory of 3656	3724	rundll32.exe	rundll32.exe
PID 3724 wrote to memory of 3656	3724	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\07fe14af3cb2a2c6c8d86580111bf0471b57475159e5de07a17dcc812a1b9d79.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3724

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\07fe14af3cb2a2c6c8d86580111bf0471b57475159e5de07a17dcc812a1b9d79.dll,#1
2⤵
PID:3656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3656-130-0x0000000000000000-mapping.dmp

Download