60f9629977d0077eeec2ae31a065468f14b9f715fbc9681306cbbc0ea46aaa0d | Triage

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 19:42

Sharing

Report Analysis Logs

General

Target

60f9629977d0077eeec2ae31a065468f14b9f715fbc9681306cbbc0ea46aaa0d.dll
Size

3KB
MD5

bb6880660c6fa38ab4e2a88d0e784157
SHA1

fcc35f6d288fd88fe1751e030cc72de2cd8a5d73
SHA256

60f9629977d0077eeec2ae31a065468f14b9f715fbc9681306cbbc0ea46aaa0d
SHA512

6fa6c49fcfea58a6f407c208277c7645ada900474bae13b55fc86619c612c5a325bb0ef143bc9ce15088f0d5d2bcda31f6494d6104d569c251518b1488b6bc61

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3996 wrote to memory of 1496	3996	rundll32.exe	rundll32.exe
PID 3996 wrote to memory of 1496	3996	rundll32.exe	rundll32.exe
PID 3996 wrote to memory of 1496	3996	rundll32.exe	rundll32.exe
PID 1496 wrote to memory of 4960	1496	rundll32.exe	wscript.exe
PID 1496 wrote to memory of 4960	1496	rundll32.exe	wscript.exe
PID 1496 wrote to memory of 4960	1496	rundll32.exe	wscript.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60f9629977d0077eeec2ae31a065468f14b9f715fbc9681306cbbc0ea46aaa0d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3996

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60f9629977d0077eeec2ae31a065468f14b9f715fbc9681306cbbc0ea46aaa0d.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\SysWOW64\wscript.exe
wscript.exe //B s.js
3⤵
PID:4960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1496-132-0x0000000000000000-mapping.dmp

Download
memory/4960-133-0x0000000000000000-mapping.dmp

Download