efd1a86330cecba5d8d038fba65ac8e76955ed724986aa87cd6ca9f72f6941c7 | Triage

Analysis

max time kernel
244s
max time network
354s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:50

Sharing

Report Analysis Logs

General

Target

oftApps.dll
Size

500KB
MD5

be231f7879d8d2159b67b7f277527268
SHA1

d73ca3707ebd61eff15dc25d9f439d6060553818
SHA256

efd1a86330cecba5d8d038fba65ac8e76955ed724986aa87cd6ca9f72f6941c7
SHA512

54ebf014160f0d5e1912d6495bc62e122296e055b548c90b63dabe1a24af6f29ec80d08eb7fe204702b2e263603f68c0e9f534e98917eb325b6dba524e20cb82
SSDEEP

6144:RQg1U4oSvkDjQ3cCT+jFa2QuoT50qWphYWxhaGqE:Rn1/ZcDM3d+a2QB0R/YWxQZE

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3244 wrote to memory of 3520	3244	rundll32.exe	rundll32.exe
PID 3244 wrote to memory of 3520	3244	rundll32.exe	rundll32.exe
PID 3244 wrote to memory of 3520	3244	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\oftApps.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3244

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\oftApps.dll,#1
2⤵
PID:3520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3520-132-0x0000000000000000-mapping.dmp

Download