8e0e38ed2f8c46569c0b1d250f3e66b190d256a7fa0824bd5d3e8bf215fb5ce2 | Triage

Analysis

max time kernel
187s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 22:24

Sharing

Report Analysis Logs

General

Target

rxbaoV3.29_Y/iext.dll
Size

212KB
MD5

f83bb2dad18f1d47a8c24a06bdc6ac51
SHA1

ff02bd076fc987b7691755450cee8a515ad815b0
SHA256

d57f5482d4d7c4e32a580054887d5913064ae3d4cef690d26639b39b7a3280c5
SHA512

8690a4ea973f440c3767a818bed3979a5099eff210ae7f7af009cfe4f77b2b3c880b618357898104ffcf3398341c4cd22cb60c2bcd44179fb38bd19a523b8060
SSDEEP

3072:xxjOeHYNcrb+6kFDej1vava1eHudpVWQuABEd9Vz8XGb7om5Ne6NlxEJ:Q69f4HWuJdTeAC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 212 wrote to memory of 632	212	rundll32.exe	rundll32.exe
PID 212 wrote to memory of 632	212	rundll32.exe	rundll32.exe
PID 212 wrote to memory of 632	212	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\rxbaoV3.29_Y\iext.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\rxbaoV3.29_Y\iext.dll,#1
  2⤵
  PID:632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/632-132-0x0000000000000000-mapping.dmp

Download