2fdd2e15d7f8300c817da9d6f45a0876e3ec2f2b519f7f2a6f618fecde709421 | Triage

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 06:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2fdd2e15d7f8300c817da9d6f45a0876e3ec2f2b519f7f2a6f618fecde709421.dll
Size

4KB
MD5

1c8fead165def7e3ae03e24fc08e985a
SHA1

aa3a5a3b06e7f3dc1c83a7b301b4965bdd0830ea
SHA256

2fdd2e15d7f8300c817da9d6f45a0876e3ec2f2b519f7f2a6f618fecde709421
SHA512

37ae37f33fd47208cc6f0618b275bcd0d9a3a0a792f8b0ce61584a087ae008da8b3aad98aa7752ed7d15418f57233f994690d4bcbc7fdb7fa5a472edfce048da

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	5096	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 5096	2592	rundll32.exe	80
PID 2592 wrote to memory of 5096	2592	rundll32.exe	80
PID 2592 wrote to memory of 5096	2592	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fdd2e15d7f8300c817da9d6f45a0876e3ec2f2b519f7f2a6f618fecde709421.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fdd2e15d7f8300c817da9d6f45a0876e3ec2f2b519f7f2a6f618fecde709421.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:5096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5096-133-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download