da9e56c2024fe19b1c9cc48154fc21cb559a9af23523963cb5471ec612eab8e5 | Triage

Analysis

max time kernel
150s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 22:58

Sharing

Report Analysis Logs

General

Target

EChartBar.dll
Size

111KB
MD5

c55a2f2a4eadd7b9d6dd69a285ba94c0
SHA1

29896ead142ec1586c6679cbfad3b3915a0759e3
SHA256

03e737400c0409bbda7f9a2c0c64de0ff66df611a2315b90264c0b502e38c37f
SHA512

bedb6f148578b02dfe66c5f32d1161e0ec671d0ceeb9e04c95e73a038faef9f57395e424c325b32db65c3248e9bfd1f5b9c4531a3002cc4f349b5f2e8e369b7d
SSDEEP

3072:l88MbWhkWun5ldiKaYacPqLMfeooE79neT4x7:l88M6k7dzPacPgK5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5012 wrote to memory of 2140	5012	rundll32.exe	rundll32.exe
PID 5012 wrote to memory of 2140	5012	rundll32.exe	rundll32.exe
PID 5012 wrote to memory of 2140	5012	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EChartBar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5012

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EChartBar.dll,#1
2⤵
PID:2140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2140-132-0x0000000000000000-mapping.dmp

Download
memory/2140-133-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download