49f3f1a6716cb7c3cca57a9d5e7249a4c68b276ebea14868d889209177a598c2 | Triage

Analysis

max time kernel
144s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 16:09

Sharing

Report Analysis Logs

General

Target

krnln.dll
Size

1.0MB
MD5

44e2ca67c060fbe3dc0d030149f5a478
SHA1

5df61eb626bc3849893701942114609c1086d496
SHA256

6ced19283dbbb95f264448f380592f4e98ba8228efca2f68821ab3ae61029d93
SHA512

1a348c7585d78dd68c1d0e059ea1d7cea57c1aeff734f834f75025719b9fdd0e9bb16aebe75e15502a1b83106387eaa9493b8990999e0a68b62c1afdbc8cf45e
SSDEEP

12288:rb0+sqCE6yy4bmhSd+1YCHYFZzktq0TNSARuOrRUVbNGvNXXYA/2b:AjE6+bhiHYF5kZI6uOrRUjYNXXYA/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4076 wrote to memory of 2180	4076	rundll32.exe	rundll32.exe
PID 4076 wrote to memory of 2180	4076	rundll32.exe	rundll32.exe
PID 4076 wrote to memory of 2180	4076	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\krnln.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4076

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\krnln.dll,#1
2⤵
PID:2180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2180-132-0x0000000000000000-mapping.dmp

Download