08e427c92010a8a282c894cf5a77a874e09c08e283a66f1905c131871cc4d273 | Triage

Resubmissions

05-07-2022 14:19

220705-rmtywsbhg7 10

09-06-2022 16:14

220609-tpy2qsebe7 1

07-06-2022 11:35

220607-np1mnsead7 1

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220414-en
submitted
09-06-2022 16:14

Sharing

Report Analysis Logs

General

Target

y3036.tmp.dll
Size

557KB
MD5

d19c5e1fb2d895ff61c0ff89cd0fc1a0
SHA1

89900c9532f88bd58382ced3ee0bc86413e0fce0
SHA256

08e427c92010a8a282c894cf5a77a874e09c08e283a66f1905c131871cc4d273
SHA512

e3dfb8c680b9575a2ffdbedfc988392bb67833c5c3c1ca23fbbf4c1a086bcacbc287c1fa3f648f60238e8e292b521f864312f5c8bba8c93057b8fe4982d14ba7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 732 wrote to memory of 1096	732	rundll32.exe	rundll32.exe
PID 732 wrote to memory of 1096	732	rundll32.exe	rundll32.exe
PID 732 wrote to memory of 1096	732	rundll32.exe	rundll32.exe
PID 732 wrote to memory of 1096	732	rundll32.exe	rundll32.exe
PID 732 wrote to memory of 1096	732	rundll32.exe	rundll32.exe
PID 732 wrote to memory of 1096	732	rundll32.exe	rundll32.exe
PID 732 wrote to memory of 1096	732	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\y3036.tmp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\y3036.tmp.dll,#1
  2⤵
  PID:1096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-54-0x0000000000000000-mapping.dmp

Download
memory/1096-55-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download
memory/1096-56-0x0000000074F70000-0x0000000075001000-memory.dmp

Filesize
580KB

Download