49f3f1a6716cb7c3cca57a9d5e7249a4c68b276ebea14868d889209177a598c2 | Triage

Analysis

max time kernel
91s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 16:09

Sharing

Report Analysis Logs

General

Target

xplib.dll
Size

80KB
MD5

8f385e7c8cf1f8ebdae0448473977cc7
SHA1

942bf465e29a5e5f85580eb30aa9510b92f802d7
SHA256

d1a1c6bac6a498adccdafab9d600a372aa9d5b826a33cfa06aaa9f75357c5b23
SHA512

2372a8857591b829763cacbdfc0cf3d4884598c5f1c43f0815257cb7fb3b2c93b60b1027480e1d5a93bbc6eba054328d8d2b4997c7d81a5360811f8f1eecafa1
SSDEEP

768:25tYWNgMBrw1cbmKrvtt9AK+HSTGwBtL9hlkU8MiP+cTqp2DYGH+toh+z9:25tY2BEe/CSTGOfqqLSCoQ9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4920 wrote to memory of 4844	4920	rundll32.exe	rundll32.exe
PID 4920 wrote to memory of 4844	4920	rundll32.exe	rundll32.exe
PID 4920 wrote to memory of 4844	4920	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xplib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4920

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xplib.dll,#1
2⤵
PID:4844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4844-132-0x0000000000000000-mapping.dmp

Download