7b59997f4efdf54a64dbbcb60c98d02dde50772b39552f9c7bd9c2fa809887b3 | Triage

Analysis

max time kernel
69s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 05:50

Sharing

Report Analysis Logs

General

Target

const.dll
Size

952KB
MD5

1718e9013e5d5a4d0e6b4890be957e37
SHA1

d3684d849d96e4b1712206f07d737a1cee94716b
SHA256

6d00e79b70e57209ae623f59480e3255d87a60858da87dcc751cd3018796f759
SHA512

6b1b2a538346bc73c30f24eb06ad217b1bbb80e880551e6107e7a0e286321e32823e3a4b6c12d1a8e34b416324247fbb5f93b54fb4f838f13f3174072e636e71
SSDEEP

12288:Cqh/i7xvXMrYsah466BEqAoketLGQQA51ictk4m:CqVCsaJOAiGQr1ica4m

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 4280	644	rundll32.exe	83
PID 644 wrote to memory of 4280	644	rundll32.exe	83
PID 644 wrote to memory of 4280	644	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\const.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\const.dll,#1
  2⤵
  PID:4280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads