e444d49db7239e7bb918d79f3b5b41facd76d913ac3baeb7d270d6a92b6a4d26 | Triage

Analysis

max time kernel
91s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2022 23:37

Sharing

Report Analysis Logs

General

Target

1148-57-0x00000000003A0000-0x00000000003C2000-memory.dll
Size

136KB
MD5

8b2af8718c8f5345851db4aa077970ea
SHA1

d44f46f7573414f443e3e1e999b5fafd35292f1d
SHA256

e444d49db7239e7bb918d79f3b5b41facd76d913ac3baeb7d270d6a92b6a4d26
SHA512

0a10899a24fd8efcd8dd87f91fdd076e14aac88e03b3c19ac78702c8eed5914739388026d23eb1dfbcd7d8f9f2835b482988400139849037c25447ce89e37102

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4556 wrote to memory of 2108	4556	rundll32.exe	rundll32.exe
PID 4556 wrote to memory of 2108	4556	rundll32.exe	rundll32.exe
PID 4556 wrote to memory of 2108	4556	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 3772	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 3772	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 3772	2108	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1148-57-0x00000000003A0000-0x00000000003C2000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4556

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1148-57-0x00000000003A0000-0x00000000003C2000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2108

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1148-57-0x00000000003A0000-0x00000000003C2000-memory.dll,#1
3⤵
PID:3772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2108-131-0x0000000000000000-mapping.dmp

Download
memory/3772-132-0x0000000000000000-mapping.dmp

Download