3a20d1c0976d357822513bab0f4abba2c914eb68a275cb19facc1245b78f77f8 | Triage

Analysis

max time kernel
180s
max time network
228s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12-07-2022 07:41

Sharing

Report Analysis Logs

General

Target

1652-57-0x00000000002C0000-0x00000000002E2000-memory.dll
Size

136KB
MD5

5449a7730d4a3454cf39db98eae4764f
SHA1

87c5253a1714f5ea1c76876ddbac3031eb97e826
SHA256

3a20d1c0976d357822513bab0f4abba2c914eb68a275cb19facc1245b78f77f8
SHA512

48388cdb33e5a1d2c44e0fb906ab81afd012a04089dcf4e69a35038139b4cbd9becee85e7335c484e29d1cbaf8ae1513b5c1b95eb9dbed92ad87d8a861586456

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exe

description	pid	process	target process
PID 2108 wrote to memory of 3268	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 3268	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 3268	2108	rundll32.exe	rundll32.exe
PID 3268 wrote to memory of 4824	3268	rundll32.exe	rundll32.exe
PID 3268 wrote to memory of 4824	3268	rundll32.exe	rundll32.exe
PID 3268 wrote to memory of 4824	3268	rundll32.exe	rundll32.exe
PID 4824 wrote to memory of 3096	4824	rundll32.exe	rundll32.exe
PID 4824 wrote to memory of 3096	4824	rundll32.exe	rundll32.exe
PID 4824 wrote to memory of 3096	4824	rundll32.exe	rundll32.exe
PID 3096 wrote to memory of 4656	3096	rundll32.exe	rundll32.exe
PID 3096 wrote to memory of 4656	3096	rundll32.exe	rundll32.exe
PID 3096 wrote to memory of 4656	3096	rundll32.exe	rundll32.exe
PID 4656 wrote to memory of 1428	4656	rundll32.exe	rundll32.exe
PID 4656 wrote to memory of 1428	4656	rundll32.exe	rundll32.exe
PID 4656 wrote to memory of 1428	4656	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1652-57-0x00000000002C0000-0x00000000002E2000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1652-57-0x00000000002C0000-0x00000000002E2000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:3268

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1652-57-0x00000000002C0000-0x00000000002E2000-memory.dll,#1
3⤵
- Suspicious use of WriteProcessMemory
PID:4824

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1652-57-0x00000000002C0000-0x00000000002E2000-memory.dll,#1
4⤵
- Suspicious use of WriteProcessMemory
PID:3096

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1652-57-0x00000000002C0000-0x00000000002E2000-memory.dll,#1
5⤵
- Suspicious use of WriteProcessMemory
PID:4656

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1652-57-0x00000000002C0000-0x00000000002E2000-memory.dll,#1
6⤵
PID:1428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1428-134-0x0000000000000000-mapping.dmp

Download
memory/3096-132-0x0000000000000000-mapping.dmp

Download
memory/3268-130-0x0000000000000000-mapping.dmp

Download
memory/4656-133-0x0000000000000000-mapping.dmp

Download
memory/4824-131-0x0000000000000000-mapping.dmp

Download