cd34dec6257383ac8208a176b712a6e785bdc9259f81732d60811f5b81e4b473 | Triage

Analysis

max time kernel
145s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 04:44

Sharing

Report Analysis Logs

General

Target

sock.dll
Size

60KB
MD5

698bd942f9334e0ab5d0c7002b13ed70
SHA1

58eb04593c14ccb0c3f703b35710faf05711465c
SHA256

9578922e34dfc8f3298e67dcaa5075d870dfdc4ef958985d5fc0e5e6b3849aa9
SHA512

e0c78360c55c31ec139e7a0d8b44e3702dc721c1ea66c9e5deb9fde2bd4122ba10012b67d0d614ecc665a68d9ceb0d8fc79d279f41e7390ef3fe2495901b7740
SSDEEP

768:Wo7bG/hX9OdejL8BK0BofPT/bz7IjG/OqhhItJ22uk8ao00O:C/hXIcjL8xufPT/bz5/OqMIYo0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2168 wrote to memory of 1296	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 1296	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 1296	2168	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sock.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\sock.dll,#1
  2⤵
  PID:1296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1296-132-0x0000000000000000-mapping.dmp

Download