8f3b18d82f2673e87dc09a63653c2aa58f58119c9d4b1775f9a7e249ab04f485 | Triage

Analysis

max time kernel
280s
max time network
347s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 05:45 UTC

Sharing

Report Analysis Logs

General

Target

8f3b18d82f2673e87dc09a63653c2aa58f58119c9d4b1775f9a7e249ab04f485.dll
Size

4KB
MD5

cf89002e4aa05e5fa4a592efcfe43b70
SHA1

1687d4c4d38df29d4ca0793665197528fbdb9b19
SHA256

8f3b18d82f2673e87dc09a63653c2aa58f58119c9d4b1775f9a7e249ab04f485
SHA512

2705c4ea8391a8d0024dcf7836753525ed198e05cd50ba19fc657265856d264bda7da528371a672031996d6276913e6f6334b53d117c631612e42eee50799432

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2756	2216	rundll32.exe	81
PID 2216 wrote to memory of 2756	2216	rundll32.exe	81
PID 2216 wrote to memory of 2756	2216	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f3b18d82f2673e87dc09a63653c2aa58f58119c9d4b1775f9a7e249ab04f485.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f3b18d82f2673e87dc09a63653c2aa58f58119c9d4b1775f9a7e249ab04f485.dll,#1
  2⤵
  PID:2756

Network

DNS

164.2.77.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

164.2.77.40.in-addr.arpa

IN PTR

Response
DNS

d.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.5.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa

Remote address:

8.8.8.8:53

Request

d.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.5.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa

IN PTR

Response

8.238.21.254:80

46 B
40 B
1
1
51.104.15.252:443

322 B
7
93.184.221.240:80

322 B
7
93.184.221.240:80

322 B
7
93.184.221.240:80

322 B
7
20.190.159.2:443

260 B
5
20.190.159.2:443

260 B
5
104.80.225.205:443

322 B
7
209.197.3.8:80

322 B
7
209.197.3.8:80

322 B
7
20.190.159.73:443

260 B
5
20.190.159.73:443

260 B
5
40.126.31.67:443

260 B
5
40.126.31.67:443

260 B
5
93.184.221.240:80

260 B
5
20.190.159.4:443

260 B
5
20.190.159.23:443

260 B
5

8.8.8.8:53

164.2.77.40.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

164.2.77.40.in-addr.arpa
8.8.8.8:53

d.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.5.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa

dns

118 B
204 B
1
1

DNS Request

d.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.5.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads