35b11704a872d0c20717c4d9fd89d1b92fc9f6dae87e3695e248b0aba96d9d32 | Triage

Resubmissions

15-07-2022 11:25

220715-njrsksabc6 10

15-07-2022 11:22

220715-ngtjdsbcdk 1

Analysis

max time kernel
53s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2022 11:22

Sharing

Report Analysis Logs

General

Target

7533.dll
Size

663KB
MD5

31779d2bf4f5db7efb378fd1db702052
SHA1

e654de30b56447a8a680d2fbb5f4a0b9fd3d7d4a
SHA256

35b11704a872d0c20717c4d9fd89d1b92fc9f6dae87e3695e248b0aba96d9d32
SHA512

e2bf4b229c23596459d586534670f12e4e1c39a0521e186af691e8c69e96121fb605597d090e983d0e0d0a2b39d054afe644ba89b91ea6a1e29456907c09f44d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1888 wrote to memory of 4592	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 4592	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 4592	1888	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7533.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1888

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7533.dll,#1
2⤵
PID:4592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4592-130-0x0000000000000000-mapping.dmp

Download