bbad923f3102f064ecf37d42f8cbbfffc02266c8bd4636f052b7e8ecf5d78d9f | Triage

Analysis

max time kernel
90s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 08:52 UTC

Sharing

Report Analysis Logs

General

Target

look/youIn.dll
Size

3KB
MD5

b83bebd6d4214aaddb333d720a56db15
SHA1

fe7562e8deb7a4ae47e5183cab2ee6e053a05bc2
SHA256

d0a3cdc531a3c40b67d9ff093dc96a19db3f5fe52d718468988b67f999b53411
SHA512

f19788a9417bfb3fed7326e7ff29b690217f354d02912fdf8460f7f0e9a3fe17aeab540f4b014d0996cff22fa9c2aaec73725a50c999f6cefed28d09d6dd2286

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 1336	1508	rundll32.exe	80
PID 1508 wrote to memory of 1336	1508	rundll32.exe	80
PID 1508 wrote to memory of 1336	1508	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\look\youIn.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\look\youIn.dll,#1
  2⤵
  PID:1336

Network

No results found

8.238.21.254:80

46 B
40 B
1
1
8.238.21.254:80

46 B
40 B
1
1
20.42.65.85:443

322 B
7
104.80.225.205:443

322 B
7
95.101.78.106:80

322 B
7
87.248.202.1:80

322 B
7
87.248.202.1:80

322 B
7
8.248.1.254:80

46 B
40 B
1
1
8.248.1.254:80

46 B
40 B
1
1

No results found

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads