23d8d581d8be6247b1074913acdc72ecfcb30c03c543773f1b62bb0b8686f9ee | Triage

Analysis

max time kernel
95s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/09/2022, 05:05

Sharing

Report Analysis Logs

General

Target

sKw˪c餤/bin/fp20ime.dll
Size

127KB
MD5

fa0e75c2fe7994843a5b9bc147ee27e0
SHA1

e009fea22580f2991dbb1ee14feb3bb8d788c1e8
SHA256

413112f6f647b6e7fd1620b39baeeedd9aa1d19ccc4cfe6292671d205f539834
SHA512

e93e36481b5d113bdaafb9e77c8b7819b8e4e407b26b0743cef48b0909bca40c0edb733fab79192495401e03fb2dc3bbf62e630d33eef0ed235f0e162ce4d69e
SSDEEP

3072:jEANYQgcpuP0QVPlPm40bV7fuzFTDvKbGUWW:jHpSzlPm40bSpDvKbVb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 4576	4216	rundll32.exe	80
PID 4216 wrote to memory of 4576	4216	rundll32.exe	80
PID 4216 wrote to memory of 4576	4216	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sKw˪c餤\bin\fp20ime.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\sKw˪c餤\bin\fp20ime.dll,#1
  2⤵
  PID:4576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4576-133-0x0000000002050000-0x0000000002139000-memory.dmp

Filesize
932KB

Download
memory/4576-134-0x00000000006D0000-0x00000000006F2000-memory.dmp

Filesize
136KB

Download
memory/4576-135-0x0000000000764000-0x0000000000776000-memory.dmp

Filesize
72KB

Download
memory/4576-137-0x0000000002160000-0x0000000002179000-memory.dmp

Filesize
100KB

Download