da9e56c2024fe19b1c9cc48154fc21cb559a9af23523963cb5471ec612eab8e5 | Triage

Analysis

max time kernel
111s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 22:58

Sharing

Report Analysis Logs

General

Target

krnln.dll
Size

1.0MB
MD5

a97880e00e1102bcfd7ba34771eced8b
SHA1

e6c631f22db689cb351e17dea9691eb460dcb3b3
SHA256

6b2a9a59920baefd2bd9c3da82bcf0405b2c56c7fd664e74eeffaefbee55afdf
SHA512

70132880538c26b0d40df23fbaf4fb1e4010e60fc9983077cfc6f7a38f7d16118efcae197cc45232b210089371428b4c102620ee783db0881f6d8be2173b66b4
SSDEEP

12288:G7EeVXIXJrSuAFGA+3EgDYRx4Wwp1dt8dbA9iTaVHHWntQKcB9IHy7Y:qXQJrStDSESYwW81d398aVHIGHIHy7Y

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3224 wrote to memory of 3044	3224	rundll32.exe	rundll32.exe
PID 3224 wrote to memory of 3044	3224	rundll32.exe	rundll32.exe
PID 3224 wrote to memory of 3044	3224	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\krnln.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3224

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\krnln.dll,#1
2⤵
PID:3044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3044-132-0x0000000000000000-mapping.dmp

Download