0a27ebf898554fd69d06b065519d39588578872a7fc478fdf673d944e1f10d93 | Triage

Analysis

max time kernel
92s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 08:52

Sharing

Report Analysis Logs

General

Target

look/youIn.dll
Size

3KB
MD5

b83bebd6d4214aaddb333d720a56db15
SHA1

fe7562e8deb7a4ae47e5183cab2ee6e053a05bc2
SHA256

d0a3cdc531a3c40b67d9ff093dc96a19db3f5fe52d718468988b67f999b53411
SHA512

f19788a9417bfb3fed7326e7ff29b690217f354d02912fdf8460f7f0e9a3fe17aeab540f4b014d0996cff22fa9c2aaec73725a50c999f6cefed28d09d6dd2286

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4204 wrote to memory of 4940	4204	rundll32.exe	rundll32.exe
PID 4204 wrote to memory of 4940	4204	rundll32.exe	rundll32.exe
PID 4204 wrote to memory of 4940	4204	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\look\youIn.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\look\youIn.dll,#1
  2⤵
  PID:4940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4940-132-0x0000000000000000-mapping.dmp

Download