0d349b6bf414eabec5f852193876fe67bcaa109089e631a2b6d72650f3b5d95f | Triage

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12-07-2022 08:17

Sharing

Report Analysis Logs

General

Target

896-57-0x0000000000AD0000-0x0000000000AF2000-memory.dll
Size

136KB
MD5

e455c6f59629f02d41ecbd2c0bc6b918
SHA1

351d693df955de8cab91472e11a09963483233ae
SHA256

0d349b6bf414eabec5f852193876fe67bcaa109089e631a2b6d72650f3b5d95f
SHA512

1917e303fb6539005b050381c4f544e752d61c7ec3ac8114e9d632dc864748aa997fe12115b244fb4ad426b007da0caa851e7a98a02fa8b6b56cec407967b9ac

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 968 wrote to memory of 5036	968	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 5036	968	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 5036	968	rundll32.exe	rundll32.exe
PID 5036 wrote to memory of 3940	5036	rundll32.exe	rundll32.exe
PID 5036 wrote to memory of 3940	5036	rundll32.exe	rundll32.exe
PID 5036 wrote to memory of 3940	5036	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\896-57-0x0000000000AD0000-0x0000000000AF2000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\896-57-0x0000000000AD0000-0x0000000000AF2000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:5036

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\896-57-0x0000000000AD0000-0x0000000000AF2000-memory.dll,#1
3⤵
PID:3940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3940-131-0x0000000000000000-mapping.dmp

Download
memory/5036-130-0x0000000000000000-mapping.dmp

Download