7b59997f4efdf54a64dbbcb60c98d02dde50772b39552f9c7bd9c2fa809887b3 | Triage

Analysis

max time kernel
136s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 05:50

Sharing

Report Analysis Logs

General

Target

script.dll
Size

164KB
MD5

f8a655e81afbd29bffb1529eb81c0bce
SHA1

7b1f082a1f8af3921536703ee4372374d28b6f05
SHA256

775f7b81401b9ee7b0a4f34809ba55c6bf816b21471c1c0797a386707da068ad
SHA512

537006acb144ada6f9499b08b42fa9e7d49c5ed040a8b1bc82742cb64efed7fed0f743f768cfbf382e9cefcc59d9b0f5e66198ddcb97d4c710ba36aa15a33a67
SSDEEP

3072:CPb/Y2so9Mmaf8XKcHs4Wzuo2kOpSznaF4z:u/IjxfApkz

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 4764	724	rundll32.exe	74
PID 724 wrote to memory of 4764	724	rundll32.exe	74
PID 724 wrote to memory of 4764	724	rundll32.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\script.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\script.dll,#1
  2⤵
  PID:4764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads