a7588b5e256303e78ad50b0f4c01b5f44623852ef4a377d3ce95ff4d56680504 | Triage

Analysis

max time kernel
90s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:53

Sharing

Report Analysis Logs

General

Target

insolvable.dll
Size

1.1MB
MD5

ef49252a27f4d4e9d72f87cb335d208f
SHA1

013ad3e104d2a16134234348c5251900babe0917
SHA256

a7588b5e256303e78ad50b0f4c01b5f44623852ef4a377d3ce95ff4d56680504
SHA512

5339a3f5ff37ef3c87f2a84fced36123f8e724c60003b6065e620ca37e03be1eb5fb8054511ec2817ffc1a1db379ba5177c83453735177aaf8e58095dfc0947b
SSDEEP

24576:g8Z3shoA9qB8DvUAZkl9iIDIQIFaOpYnknF6:g8vmqB8DUAZklKYnknF6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 644 wrote to memory of 360	644	rundll32.exe	rundll32.exe
PID 644 wrote to memory of 360	644	rundll32.exe	rundll32.exe
PID 644 wrote to memory of 360	644	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\insolvable.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:644

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\insolvable.dll,#1
2⤵
PID:360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/360-132-0x0000000000000000-mapping.dmp

Download