616bcbdf22d158d059b76ba21914d353ae9c86e17e833e74ab8a7519e98264ab | Triage

Analysis

max time kernel
90s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12-07-2022 07:03

Sharing

Report Analysis Logs

General

Target

616bcbdf22d158d059b76ba21914d353ae9c86e17e833e74ab8a7519e98264ab.dll
Size

686KB
MD5

bec4f27d2062bc6759f387088d6772f0
SHA1

2d373eb818ce1410273a4a1dbdfa68a733e3f746
SHA256

616bcbdf22d158d059b76ba21914d353ae9c86e17e833e74ab8a7519e98264ab
SHA512

b09eaeb3333f2efb031c1e527f61cb524e8c6453a9f0ce135746332d48e3bc23e6756f9b8b91fa1ae99218c754a4c4fb80be0cc85561bbcdcb234fb11f700e41

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4900 wrote to memory of 3196	4900	rundll32.exe	rundll32.exe
PID 4900 wrote to memory of 3196	4900	rundll32.exe	rundll32.exe
PID 4900 wrote to memory of 3196	4900	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\616bcbdf22d158d059b76ba21914d353ae9c86e17e833e74ab8a7519e98264ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4900

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\616bcbdf22d158d059b76ba21914d353ae9c86e17e833e74ab8a7519e98264ab.dll,#1
2⤵
PID:3196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3196-130-0x0000000000000000-mapping.dmp

Download