e0accb4407df08ec103be2d05017a3f3b37459c0784f9feb4eaf50122bfcd80e | Triage

Analysis

max time kernel
90s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
08-09-2022 13:53

Sharing

Report Analysis Logs

General

Target

a3.png.dll
Size

525KB
MD5

2e504995ae2b91cf9d5fbf3f250fef44
SHA1

e1b42fcce91e2dad6ebea6a25563a39d77f031e7
SHA256

e0accb4407df08ec103be2d05017a3f3b37459c0784f9feb4eaf50122bfcd80e
SHA512

f8774ea5086ee45555dc772a7a90f44b659406af7a5a58e6879832daefe7224d010ccc282c706c516db88ff08b0bc4dea8a58e4626a04abd491fa37bb543614f
SSDEEP

12288:pWghjfsaHKisYUVJAEvyxNEUDpyujPt5ABJXT+g/:gijHHKH53vUEUF1D4XTj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4568 wrote to memory of 5092	4568	rundll32.exe	rundll32.exe
PID 4568 wrote to memory of 5092	4568	rundll32.exe	rundll32.exe
PID 4568 wrote to memory of 5092	4568	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3.png.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4568

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3.png.dll,#1
2⤵
PID:5092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5092-132-0x0000000000000000-mapping.dmp

Download
memory/5092-133-0x0000000000B80000-0x0000000000C06000-memory.dmp

Filesize
536KB

Download