Analysis
-
max time kernel
181s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2022 02:47
Static task
static1
Behavioral task
behavioral1
Sample
745945b2c57abab520e17b765e84d1d09fad1124cad8439c568c2c1a332e21ef.dll
Resource
win7-20220812-en
2 signatures
150 seconds
General
-
Target
745945b2c57abab520e17b765e84d1d09fad1124cad8439c568c2c1a332e21ef.dll
-
Size
374KB
-
MD5
e4084330522303a4f1281dc798147659
-
SHA1
18d09845c013bd067feeadd49599812121bafbca
-
SHA256
745945b2c57abab520e17b765e84d1d09fad1124cad8439c568c2c1a332e21ef
-
SHA512
49e358496d3f5128e39aa327bca53067b372710230186318d876051554fed189d3f15d983cdc3062f473484abc59040c8b2e0840ba780c3b70d502b3ee67c123
-
SSDEEP
3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0Q:jDgtfRQUHPw06MoV2nwTBlhm84
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2172 wrote to memory of 2540 2172 rundll32.exe rundll32.exe PID 2172 wrote to memory of 2540 2172 rundll32.exe rundll32.exe PID 2172 wrote to memory of 2540 2172 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\745945b2c57abab520e17b765e84d1d09fad1124cad8439c568c2c1a332e21ef.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\745945b2c57abab520e17b765e84d1d09fad1124cad8439c568c2c1a332e21ef.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2540-132-0x0000000000000000-mapping.dmp