576ca01f7fc02b95b7cb2b93815930040fcbfe685fcd7fdccba441f1f28cca46 | Triage

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12-07-2022 07:22

Sharing

Report Analysis Logs

General

Target

1696-57-0x0000000000310000-0x0000000000332000-memory.dll
Size

136KB
MD5

fd79457e4f750fc55ccbb103df32af91
SHA1

a7e728670197ce3464e2d191b1ef6965992a149b
SHA256

576ca01f7fc02b95b7cb2b93815930040fcbfe685fcd7fdccba441f1f28cca46
SHA512

da252c8f394b37a5babd355f6c43011f70b66da4e33bc5636fd1ae800dd6c08c3c39f3be79b6b15cdfbd91ac79d921a7c6d5ac59bb71d32937900a5befbd5c8e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exe

description	pid	process	target process
PID 2004 wrote to memory of 1620	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 1620	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 1620	2004	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 4976	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 4976	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 4976	1620	rundll32.exe	rundll32.exe
PID 4976 wrote to memory of 3352	4976	rundll32.exe	rundll32.exe
PID 4976 wrote to memory of 3352	4976	rundll32.exe	rundll32.exe
PID 4976 wrote to memory of 3352	4976	rundll32.exe	rundll32.exe
PID 3352 wrote to memory of 548	3352	rundll32.exe	rundll32.exe
PID 3352 wrote to memory of 548	3352	rundll32.exe	rundll32.exe
PID 3352 wrote to memory of 548	3352	rundll32.exe	rundll32.exe
PID 548 wrote to memory of 1012	548	rundll32.exe	rundll32.exe
PID 548 wrote to memory of 1012	548	rundll32.exe	rundll32.exe
PID 548 wrote to memory of 1012	548	rundll32.exe	rundll32.exe
PID 1012 wrote to memory of 3472	1012	rundll32.exe	rundll32.exe
PID 1012 wrote to memory of 3472	1012	rundll32.exe	rundll32.exe
PID 1012 wrote to memory of 3472	1012	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1696-57-0x0000000000310000-0x0000000000332000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1696-57-0x0000000000310000-0x0000000000332000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1696-57-0x0000000000310000-0x0000000000332000-memory.dll,#1
3⤵
- Suspicious use of WriteProcessMemory
PID:4976

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1696-57-0x0000000000310000-0x0000000000332000-memory.dll,#1
4⤵
- Suspicious use of WriteProcessMemory
PID:3352

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1696-57-0x0000000000310000-0x0000000000332000-memory.dll,#1
5⤵
- Suspicious use of WriteProcessMemory
PID:548

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1696-57-0x0000000000310000-0x0000000000332000-memory.dll,#1
6⤵
- Suspicious use of WriteProcessMemory
PID:1012

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1696-57-0x0000000000310000-0x0000000000332000-memory.dll,#1
7⤵
PID:3472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/548-133-0x0000000000000000-mapping.dmp

Download
memory/1012-134-0x0000000000000000-mapping.dmp

Download
memory/1620-130-0x0000000000000000-mapping.dmp

Download
memory/3352-132-0x0000000000000000-mapping.dmp

Download
memory/3472-135-0x0000000000000000-mapping.dmp

Download
memory/4976-131-0x0000000000000000-mapping.dmp

Download