08e427c92010a8a282c894cf5a77a874e09c08e283a66f1905c131871cc4d273 | Triage

Resubmissions

05-07-2022 14:19

220705-rmtywsbhg7 10

09-06-2022 16:14

220609-tpy2qsebe7 1

07-06-2022 11:35

220607-np1mnsead7 1

Analysis

max time kernel
136s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
07-06-2022 11:35

Sharing

Report Analysis Logs

General

Target

y3036.tmp.dll
Size

557KB
MD5

d19c5e1fb2d895ff61c0ff89cd0fc1a0
SHA1

89900c9532f88bd58382ced3ee0bc86413e0fce0
SHA256

08e427c92010a8a282c894cf5a77a874e09c08e283a66f1905c131871cc4d273
SHA512

e3dfb8c680b9575a2ffdbedfc988392bb67833c5c3c1ca23fbbf4c1a086bcacbc287c1fa3f648f60238e8e292b521f864312f5c8bba8c93057b8fe4982d14ba7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2416 wrote to memory of 3892	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 3892	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 3892	2416	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\y3036.tmp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\y3036.tmp.dll,#1
  2⤵
  PID:3892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3892-130-0x0000000000000000-mapping.dmp

Download
memory/3892-131-0x0000000074F00000-0x0000000074F91000-memory.dmp

Filesize
580KB

Download