02f5f109806f804e2b164cc7486d081de04d0569312969f80754b5da1382be12 | Triage

Analysis

max time kernel
148s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12-07-2022 07:30

Sharing

Report Analysis Logs

General

Target

1912-57-0x0000000000780000-0x00000000007A2000-memory.dll
Size

136KB
MD5

2d474c8d1e151769e680ab8f4298214e
SHA1

e0fb4a6c04da8a9a01936d125f58865fd3ea33ec
SHA256

02f5f109806f804e2b164cc7486d081de04d0569312969f80754b5da1382be12
SHA512

75f03395a5a5ee17006859fd0f4c464cb05859d5682a8fcedf38da250d7f16f36340b219e4a47d7d62a7dae6628773188785c4067dc89d5d1bc1db05e50c62a5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

rundll32.exerundll32.exerundll32.exe

description	pid	process	target process
PID 2880 wrote to memory of 4824	2880	rundll32.exe	rundll32.exe
PID 2880 wrote to memory of 4824	2880	rundll32.exe	rundll32.exe
PID 2880 wrote to memory of 4824	2880	rundll32.exe	rundll32.exe
PID 4824 wrote to memory of 2348	4824	rundll32.exe	rundll32.exe
PID 4824 wrote to memory of 2348	4824	rundll32.exe	rundll32.exe
PID 4824 wrote to memory of 2348	4824	rundll32.exe	rundll32.exe
PID 2348 wrote to memory of 2660	2348	rundll32.exe	rundll32.exe
PID 2348 wrote to memory of 2660	2348	rundll32.exe	rundll32.exe
PID 2348 wrote to memory of 2660	2348	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1912-57-0x0000000000780000-0x00000000007A2000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2880

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1912-57-0x0000000000780000-0x00000000007A2000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:4824

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1912-57-0x0000000000780000-0x00000000007A2000-memory.dll,#1
3⤵
- Suspicious use of WriteProcessMemory
PID:2348

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1912-57-0x0000000000780000-0x00000000007A2000-memory.dll,#1
4⤵
PID:2660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2348-131-0x0000000000000000-mapping.dmp

Download
memory/2660-132-0x0000000000000000-mapping.dmp

Download
memory/4824-130-0x0000000000000000-mapping.dmp

Download