a67b23e806d1e74ad0043fd323500d1e30ebbe2ffed18de09b5059a9f4e5990f | Triage

Analysis

max time kernel
193s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 08:48

Sharing

Report Analysis Logs

General

Target

a67b23e806d1e74ad0043fd323500d1e30ebbe2ffed18de09b5059a9f4e5990f.dll
Size

164KB
MD5

e5e1481d1be4dbfd85186dfb84df9aa3
SHA1

bce53c099e215c2f9b8d3c4bebeeff1f3b03fe54
SHA256

a67b23e806d1e74ad0043fd323500d1e30ebbe2ffed18de09b5059a9f4e5990f
SHA512

cfbd97e819aadcadd9e1e5602b27034873c160fefb0483fdb23f420b6e87ed49591a401a0adff61a8335bca77bea15d8f7e1288072ff8fed6f6cd907e8327f5c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4104 wrote to memory of 4888	4104	rundll32.exe	rundll32.exe
PID 4104 wrote to memory of 4888	4104	rundll32.exe	rundll32.exe
PID 4104 wrote to memory of 4888	4104	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a67b23e806d1e74ad0043fd323500d1e30ebbe2ffed18de09b5059a9f4e5990f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4104

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a67b23e806d1e74ad0043fd323500d1e30ebbe2ffed18de09b5059a9f4e5990f.dll,#1
2⤵
PID:4888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4888-130-0x0000000000000000-mapping.dmp

Download