Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 17:09
Static task
static1
Behavioral task
behavioral1
Sample
fc1b98badadd87d65413b1814c80d8976b87345f1802ca058e10829c4521a30d.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fc1b98badadd87d65413b1814c80d8976b87345f1802ca058e10829c4521a30d.dll
Resource
win10v2004-20221111-en
General
-
Target
fc1b98badadd87d65413b1814c80d8976b87345f1802ca058e10829c4521a30d.dll
-
Size
71KB
-
MD5
43366d9ba75fda843478a336bcd1cec0
-
SHA1
0a4ac291855efe5992a8ab4038e154793cd987c1
-
SHA256
fc1b98badadd87d65413b1814c80d8976b87345f1802ca058e10829c4521a30d
-
SHA512
181c27ed05df282859da5bedd3bf9cdc406b8409437448b26a1913f82a3990f3af2099b7096decb254a0d93c7d8ea71802411f3bea644ecc397e9074abd0e46f
-
SSDEEP
1536:IyJ4TX5OTkrWSW84mYId5hyZZVae2ZnuHLbs4Qz:IyJ4TX5OKWBrmfrEZChSs4Q
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3588 wrote to memory of 1476 3588 rundll32.exe rundll32.exe PID 3588 wrote to memory of 1476 3588 rundll32.exe rundll32.exe PID 3588 wrote to memory of 1476 3588 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fc1b98badadd87d65413b1814c80d8976b87345f1802ca058e10829c4521a30d.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fc1b98badadd87d65413b1814c80d8976b87345f1802ca058e10829c4521a30d.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1476-132-0x0000000000000000-mapping.dmp
-
memory/1476-133-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/1476-134-0x00000000014B0000-0x00000000014C6000-memory.dmpFilesize
88KB
-
memory/1476-135-0x00000000014B0000-0x00000000014C6000-memory.dmpFilesize
88KB