Analysis
-
max time kernel
91s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 15:52
Static task
static1
Behavioral task
behavioral1
Sample
876a3715784b3b6ca4493eab2e573bca99fd632e1f7be0e0a9fb00219094fb50.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
876a3715784b3b6ca4493eab2e573bca99fd632e1f7be0e0a9fb00219094fb50.dll
Resource
win10v2004-20220901-en
General
-
Target
876a3715784b3b6ca4493eab2e573bca99fd632e1f7be0e0a9fb00219094fb50.dll
-
Size
94KB
-
MD5
723769ad7b14edb2ea8a8d9121fde1c4
-
SHA1
be98d6f2862a8d06e599ec961670ebc63965b840
-
SHA256
876a3715784b3b6ca4493eab2e573bca99fd632e1f7be0e0a9fb00219094fb50
-
SHA512
6cc4899eb5bdbfc723d18633692ed8f92082cae7eec79c1f3606ced79c5edf41b30bae4b05af490ffbb6098cdb7ed715f1fa23a68027a40f4692fb3313aa7b7e
-
SSDEEP
1536:iUqXwQIvdCl+ffCKh3b1s2XZFZK0Nc65IfbT6Rq05cst2x1HuHfJ5f0Mubar:IwVGQCC3ps2X3ZK0GtfbT6RP5lQuHxeu
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4880 wrote to memory of 528 4880 rundll32.exe rundll32.exe PID 4880 wrote to memory of 528 4880 rundll32.exe rundll32.exe PID 4880 wrote to memory of 528 4880 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\876a3715784b3b6ca4493eab2e573bca99fd632e1f7be0e0a9fb00219094fb50.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\876a3715784b3b6ca4493eab2e573bca99fd632e1f7be0e0a9fb00219094fb50.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/528-132-0x0000000000000000-mapping.dmp