Analysis
-
max time kernel
90s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
27-06-2022 11:28
Static task
static1
Behavioral task
behavioral1
Sample
1944-57-0x0000000000200000-0x0000000000222000-memory.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1944-57-0x0000000000200000-0x0000000000222000-memory.dll
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
1944-57-0x0000000000200000-0x0000000000222000-memory.dll
-
Size
136KB
-
MD5
39b7b2617a589066b75045b2b5be852b
-
SHA1
0e5c116bba9fef10a5567e87369368e52a4b0631
-
SHA256
5e27f206cca8c47995cbb6b9a3ad649d76941c48eda11ece878090ca01a54003
-
SHA512
db939fae1e4104cc8e431b598e0ceedf78a95ac075d5e110a9e8e597cabe239e964fbd805c058df6dca0a605f72d5388e6d37be84b0249d8873778692f600cf1
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exedescription pid process target process PID 1844 wrote to memory of 2052 1844 rundll32.exe rundll32.exe PID 1844 wrote to memory of 2052 1844 rundll32.exe rundll32.exe PID 1844 wrote to memory of 2052 1844 rundll32.exe rundll32.exe PID 2052 wrote to memory of 616 2052 rundll32.exe rundll32.exe PID 2052 wrote to memory of 616 2052 rundll32.exe rundll32.exe PID 2052 wrote to memory of 616 2052 rundll32.exe rundll32.exe PID 616 wrote to memory of 536 616 rundll32.exe rundll32.exe PID 616 wrote to memory of 536 616 rundll32.exe rundll32.exe PID 616 wrote to memory of 536 616 rundll32.exe rundll32.exe PID 536 wrote to memory of 2784 536 rundll32.exe rundll32.exe PID 536 wrote to memory of 2784 536 rundll32.exe rundll32.exe PID 536 wrote to memory of 2784 536 rundll32.exe rundll32.exe PID 2784 wrote to memory of 1524 2784 rundll32.exe rundll32.exe PID 2784 wrote to memory of 1524 2784 rundll32.exe rundll32.exe PID 2784 wrote to memory of 1524 2784 rundll32.exe rundll32.exe PID 1524 wrote to memory of 4268 1524 rundll32.exe rundll32.exe PID 1524 wrote to memory of 4268 1524 rundll32.exe rundll32.exe PID 1524 wrote to memory of 4268 1524 rundll32.exe rundll32.exe PID 4268 wrote to memory of 4160 4268 rundll32.exe rundll32.exe PID 4268 wrote to memory of 4160 4268 rundll32.exe rundll32.exe PID 4268 wrote to memory of 4160 4268 rundll32.exe rundll32.exe PID 4160 wrote to memory of 4216 4160 rundll32.exe rundll32.exe PID 4160 wrote to memory of 4216 4160 rundll32.exe rundll32.exe PID 4160 wrote to memory of 4216 4160 rundll32.exe rundll32.exe PID 4216 wrote to memory of 4252 4216 rundll32.exe rundll32.exe PID 4216 wrote to memory of 4252 4216 rundll32.exe rundll32.exe PID 4216 wrote to memory of 4252 4216 rundll32.exe rundll32.exe PID 4252 wrote to memory of 4960 4252 rundll32.exe rundll32.exe PID 4252 wrote to memory of 4960 4252 rundll32.exe rundll32.exe PID 4252 wrote to memory of 4960 4252 rundll32.exe rundll32.exe PID 4960 wrote to memory of 5004 4960 rundll32.exe rundll32.exe PID 4960 wrote to memory of 5004 4960 rundll32.exe rundll32.exe PID 4960 wrote to memory of 5004 4960 rundll32.exe rundll32.exe PID 5004 wrote to memory of 4720 5004 rundll32.exe rundll32.exe PID 5004 wrote to memory of 4720 5004 rundll32.exe rundll32.exe PID 5004 wrote to memory of 4720 5004 rundll32.exe rundll32.exe PID 4720 wrote to memory of 3544 4720 rundll32.exe rundll32.exe PID 4720 wrote to memory of 3544 4720 rundll32.exe rundll32.exe PID 4720 wrote to memory of 3544 4720 rundll32.exe rundll32.exe PID 3544 wrote to memory of 2556 3544 rundll32.exe rundll32.exe PID 3544 wrote to memory of 2556 3544 rundll32.exe rundll32.exe PID 3544 wrote to memory of 2556 3544 rundll32.exe rundll32.exe PID 2556 wrote to memory of 3332 2556 rundll32.exe rundll32.exe PID 2556 wrote to memory of 3332 2556 rundll32.exe rundll32.exe PID 2556 wrote to memory of 3332 2556 rundll32.exe rundll32.exe PID 3332 wrote to memory of 3968 3332 rundll32.exe rundll32.exe PID 3332 wrote to memory of 3968 3332 rundll32.exe rundll32.exe PID 3332 wrote to memory of 3968 3332 rundll32.exe rundll32.exe PID 3968 wrote to memory of 1420 3968 rundll32.exe rundll32.exe PID 3968 wrote to memory of 1420 3968 rundll32.exe rundll32.exe PID 3968 wrote to memory of 1420 3968 rundll32.exe rundll32.exe PID 1420 wrote to memory of 3188 1420 rundll32.exe rundll32.exe PID 1420 wrote to memory of 3188 1420 rundll32.exe rundll32.exe PID 1420 wrote to memory of 3188 1420 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-57-0x0000000000200000-0x0000000000222000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-57-0x0000000000200000-0x0000000000222000-memory.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-57-0x0000000000200000-0x0000000000222000-memory.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-57-0x0000000000200000-0x0000000000222000-memory.dll,#14⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-57-0x0000000000200000-0x0000000000222000-memory.dll,#15⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-57-0x0000000000200000-0x0000000000222000-memory.dll,#16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-57-0x0000000000200000-0x0000000000222000-memory.dll,#17⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-57-0x0000000000200000-0x0000000000222000-memory.dll,#18⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-57-0x0000000000200000-0x0000000000222000-memory.dll,#19⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-57-0x0000000000200000-0x0000000000222000-memory.dll,#110⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-57-0x0000000000200000-0x0000000000222000-memory.dll,#111⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-57-0x0000000000200000-0x0000000000222000-memory.dll,#112⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-57-0x0000000000200000-0x0000000000222000-memory.dll,#113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-57-0x0000000000200000-0x0000000000222000-memory.dll,#114⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-57-0x0000000000200000-0x0000000000222000-memory.dll,#115⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-57-0x0000000000200000-0x0000000000222000-memory.dll,#116⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-57-0x0000000000200000-0x0000000000222000-memory.dll,#117⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-57-0x0000000000200000-0x0000000000222000-memory.dll,#118⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-57-0x0000000000200000-0x0000000000222000-memory.dll,#119⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/536-132-0x0000000000000000-mapping.dmp
-
memory/616-131-0x0000000000000000-mapping.dmp
-
memory/1420-146-0x0000000000000000-mapping.dmp
-
memory/1524-134-0x0000000000000000-mapping.dmp
-
memory/2052-130-0x0000000000000000-mapping.dmp
-
memory/2556-143-0x0000000000000000-mapping.dmp
-
memory/2784-133-0x0000000000000000-mapping.dmp
-
memory/3188-147-0x0000000000000000-mapping.dmp
-
memory/3332-144-0x0000000000000000-mapping.dmp
-
memory/3544-142-0x0000000000000000-mapping.dmp
-
memory/3968-145-0x0000000000000000-mapping.dmp
-
memory/4160-136-0x0000000000000000-mapping.dmp
-
memory/4216-137-0x0000000000000000-mapping.dmp
-
memory/4252-138-0x0000000000000000-mapping.dmp
-
memory/4268-135-0x0000000000000000-mapping.dmp
-
memory/4720-141-0x0000000000000000-mapping.dmp
-
memory/4960-139-0x0000000000000000-mapping.dmp
-
memory/5004-140-0x0000000000000000-mapping.dmp