ae6a6bd412bef8f0baeddb6871bf61e0e14c15a29d6947e5dd21a2c8c3c0fd10 | Triage

Analysis

max time kernel
123s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-09-2022 11:42

Sharing

Report Analysis Logs

General

Target

1f0000.dll
Size

43KB
MD5

c5d5bbe7532ee239898246a31f110224
SHA1

bebf6d50a0ddc048efb4e6da7eb0cf42ff21680f
SHA256

ae6a6bd412bef8f0baeddb6871bf61e0e14c15a29d6947e5dd21a2c8c3c0fd10
SHA512

e6bf38a01af969964091a9a2a2f70fe71deb44842d3e7ed02d99e0a7ed34edaddb8fb8e3789b674741baea39111cc0e13f707ec11cf7a085d1693c93bfc026b5
SSDEEP

768:JibfzHdW3Q0Jfb7cY4ig5sfCQygT8bf1OTNFDMu+AFWHuA:e7HdgfncFig5sfCQyXz1OTbDMyYHuA

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 5056 wrote to memory of 4972	5056	rundll32.exe	83
PID 5056 wrote to memory of 4972	5056	rundll32.exe	83
PID 5056 wrote to memory of 4972	5056	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f0000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f0000.dll,#1
  2⤵
  PID:4972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4972-132-0x0000000000000000-mapping.dmp

Download