Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 12:51
Static task
static1
Behavioral task
behavioral1
Sample
b2990b163771e38faa4d79a7590a0887e088a8ad89f793660983c29ce42cb6cf.dll
Resource
win7-20220812-en
windows7-x64
2 signatures
150 seconds
General
-
Target
b2990b163771e38faa4d79a7590a0887e088a8ad89f793660983c29ce42cb6cf.dll
-
Size
367KB
-
MD5
6c59f228c1dda5c7c428dd8c4438a4b0
-
SHA1
9a4fe04865efbdf185fcaefd0cb0b8193f51f18a
-
SHA256
b2990b163771e38faa4d79a7590a0887e088a8ad89f793660983c29ce42cb6cf
-
SHA512
00d420af28973f4c4b7a2edd82b40b3dd1a8e91f2637df735944c46bb84587872cbedf2c709ceae9666b735039c313a7449be5f9acd25b0bf22dba1343ad6c44
-
SSDEEP
3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q09:jDgtfRQUHPw06MoV2nwTBlhm8l
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4960 wrote to memory of 4852 4960 rundll32.exe rundll32.exe PID 4960 wrote to memory of 4852 4960 rundll32.exe rundll32.exe PID 4960 wrote to memory of 4852 4960 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b2990b163771e38faa4d79a7590a0887e088a8ad89f793660983c29ce42cb6cf.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b2990b163771e38faa4d79a7590a0887e088a8ad89f793660983c29ce42cb6cf.dll,#12⤵PID:4852
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4852-132-0x0000000000000000-mapping.dmp