Analysis
-
max time kernel
154s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2022 15:06
Static task
static1
Behavioral task
behavioral1
Sample
171f2ae98ea7a4dd9d7801a06cea46a15fe91c937c3bae01d1e6937ed880cee6.dll
Resource
win7-20220812-en
2 signatures
150 seconds
General
-
Target
171f2ae98ea7a4dd9d7801a06cea46a15fe91c937c3bae01d1e6937ed880cee6.dll
-
Size
742KB
-
MD5
08f54da040229e0fba57386a0372b300
-
SHA1
c0ff2234969669aabdde03eaf412a861818e8750
-
SHA256
171f2ae98ea7a4dd9d7801a06cea46a15fe91c937c3bae01d1e6937ed880cee6
-
SHA512
7a530b4adbc96258945fcf687bc9a1930b464012892dabf04894638ba35f5aff33029507c23a40be8a04af380854cef3fd98ea762be2d1a40045ae66b9239332
-
SSDEEP
3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0K:jDgtfRQUHPw06MoV2nwTBlhm8S
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3732 wrote to memory of 884 3732 rundll32.exe rundll32.exe PID 3732 wrote to memory of 884 3732 rundll32.exe rundll32.exe PID 3732 wrote to memory of 884 3732 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\171f2ae98ea7a4dd9d7801a06cea46a15fe91c937c3bae01d1e6937ed880cee6.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\171f2ae98ea7a4dd9d7801a06cea46a15fe91c937c3bae01d1e6937ed880cee6.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/884-132-0x0000000000000000-mapping.dmp