204675ed11d30dd3dbc631f798b4364c128eb4e9413f1da195790abf880e8b9a | Triage

Analysis

max time kernel
42s
max time network
52s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12-08-2022 17:41

Sharing

Report Analysis Logs

General

Target

libmbedcrypto.dll
Size

518KB
MD5

8fd812a3662ac33cfd688d2f0efb9254
SHA1

15e1c73e64172f58c0b2341b05b6efaec7bd090e
SHA256

11c81bb55645e28060fd0384bdbfaceda46beef9c517e71fe13af1c53e26d39a
SHA512

5a5957f7c6e62d291cedccaac8cc8d25b63470b5b6b79701e4eb9f1ec8d2c0897dc5cea64ba9847c76cc4522206a0798d9caefcac820def645084b98d07fc845

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1632 wrote to memory of 752	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 752	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 752	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 752	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 752	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 752	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 752	1632	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libmbedcrypto.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libmbedcrypto.dll,#1
2⤵
PID:752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-54-0x0000000000000000-mapping.dmp

Download
memory/752-55-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download