e2d3d97ee7a4af443b9ee0eb0bfbe1a2aecffc149284108d7e0c12c5596057f7 | Triage

Analysis

max time kernel
90s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
14-07-2022 22:56

Sharing

Report Analysis Logs

General

Target

e2d3d97ee7a4af443b9ee0eb0bfbe1a2aecffc149284108d7e0c12c5596057f7.dll
Size

663KB
MD5

90c7b8f66c18c1e7b06ebd9c8a7f731d
SHA1

006661029b1678bb29b65c359c1c80fe69509313
SHA256

e2d3d97ee7a4af443b9ee0eb0bfbe1a2aecffc149284108d7e0c12c5596057f7
SHA512

ab01a3a71b9572fa33e79fcae483ad2ed2cb21feda48acb193aaef15f8a62536034975f8ace6aa2e2ddd999f86d534c320cdd20a1e67ed6e0e00b5f529dfd54e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1340 wrote to memory of 616	1340	rundll32.exe	rundll32.exe
PID 1340 wrote to memory of 616	1340	rundll32.exe	rundll32.exe
PID 1340 wrote to memory of 616	1340	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2d3d97ee7a4af443b9ee0eb0bfbe1a2aecffc149284108d7e0c12c5596057f7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2d3d97ee7a4af443b9ee0eb0bfbe1a2aecffc149284108d7e0c12c5596057f7.dll,#1
2⤵
PID:616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/616-130-0x0000000000000000-mapping.dmp

Download