81fcf528fa920f5af4f079448113be7eb1c00300f47d8b43e7637c8e2bcfc9a1 | Triage

Analysis

max time kernel
131s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
11-07-2022 17:53

Sharing

Report Analysis Logs

General

Target

1660-57-0x0000000001B40000-0x0000000001B62000-memory.dll
Size

136KB
MD5

c49bc076101440704dfc5f13a65917a0
SHA1

670702a90bca904c78a40b06ca7d21c95f3251f5
SHA256

81fcf528fa920f5af4f079448113be7eb1c00300f47d8b43e7637c8e2bcfc9a1
SHA512

8e47821da1eb8ecc9806c8b2d1d8ea7e439cd4e2439170115501d858cacf681877969fae7141ea5768de17e45eca1bcbe6eb6dc70c20ff7c25d7eb7ebb71b7e6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1092 wrote to memory of 4340	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 4340	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 4340	1092	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1660-57-0x0000000001B40000-0x0000000001B62000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1660-57-0x0000000001B40000-0x0000000001B62000-memory.dll,#1
2⤵
PID:4340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4340-130-0x0000000000000000-mapping.dmp

Download