357b994cf1840ccd15970656a2c42d5fa3491be76e08d063c9e7ca4b9c334da6 | Triage™

Analysis

max time kernel
111s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
08/07/2022, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NG2T.dll
Size 670KB
Sample220708-3fdh4sdaa9
SHA256 357b994cf1840ccd15970656a2c42d5fa3491be76e08d063c9e7ca4b9c334da6
MD5 f1cb6e147997c82156caab15b0fc9fcd
SHA1 069506e9837566d79579f8f62ba7973669d089ad
SHA512 6923572e3d6406d6849c7ef1ff6810e3b86360287a517260d1e23b61cebee045cdf203f82610215e7ba8a6190e21d26783d1843fc892add83821947227766d78
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 4112	3392	rundll32.exe	81
PID 3392 wrote to memory of 4112	3392	rundll32.exe	81
PID 3392 wrote to memory of 4112	3392	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NG2T.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NG2T.dll,#1
  2⤵
  PID:4112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4112-134-0x0000000000AE0000-0x0000000000B8A000-memory.dmp

Download