Analysis
-
max time kernel
105s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2022 20:51
Static task
static1
Behavioral task
behavioral1
Sample
current/06917 Dec 01.vhd
Resource
macos-20220504-en
Behavioral task
behavioral2
Sample
06917 Dec 01.lnk
Resource
win7-20220812-en
Behavioral task
behavioral3
Sample
06917 Dec 01.lnk
Resource
win10v2004-20220901-en
Behavioral task
behavioral4
Sample
322.dll
Resource
win7-20220812-en
Behavioral task
behavioral5
Sample
322.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral6
Sample
System Volume Information/WPSettings.dat
Resource
win7-20220901-en
Behavioral task
behavioral7
Sample
System Volume Information/WPSettings.dat
Resource
win10v2004-20220812-en
General
-
Target
322.dll
-
Size
600KB
-
MD5
36bfb619fb05c2e736e27c870d551de7
-
SHA1
204998bb8778ace62e586b682479931fee6b3691
-
SHA256
998baec3eda761286f427dcd37c5252ccb97da257b67667502c367853be886f6
-
SHA512
a358c654d4c9744aae04a183e37317a14ac5177f7936dd8a81f8c0784ff1fc93025dcc1f2309b76c83d8f2c22bb3fcc63af096d7a35556177e800853f96d9db3
-
SSDEEP
12288:QSUUEfo5I6/o2qgkpUdw9Msme0CWUdOWk4F:QSTiWDvL8Rme0C0Wk4
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2224 wrote to memory of 1592 2224 rundll32.exe rundll32.exe PID 2224 wrote to memory of 1592 2224 rundll32.exe rundll32.exe PID 2224 wrote to memory of 1592 2224 rundll32.exe rundll32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1592-132-0x0000000000000000-mapping.dmp