Analysis
-
max time kernel
149s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2022 17:33
Static task
static1
Behavioral task
behavioral1
Sample
ec5a98f900ddb60a9bbbe0fba1219546c30444228eaa668c476871be57eb7d7a.dll
Resource
win7-20221111-en
2 signatures
150 seconds
General
-
Target
ec5a98f900ddb60a9bbbe0fba1219546c30444228eaa668c476871be57eb7d7a.dll
-
Size
235KB
-
MD5
3a28003465de3c821f52064addfbc470
-
SHA1
a9db3396f420bfe6cd5c118ce6eb88c24dc530d7
-
SHA256
ec5a98f900ddb60a9bbbe0fba1219546c30444228eaa668c476871be57eb7d7a
-
SHA512
bbca6403cf9c2c7da9675e32348fb4fb00542e2eb4e388ddbedc38314e04cc66e67e7d9e904cdd751ba583137d426fee7fd482ec2ce650cc2609380e03dcb0dc
-
SSDEEP
3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0p:jDgtfRQUHPw06MoV2nwTBlhm8x
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4304 wrote to memory of 5104 4304 rundll32.exe rundll32.exe PID 4304 wrote to memory of 5104 4304 rundll32.exe rundll32.exe PID 4304 wrote to memory of 5104 4304 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ec5a98f900ddb60a9bbbe0fba1219546c30444228eaa668c476871be57eb7d7a.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ec5a98f900ddb60a9bbbe0fba1219546c30444228eaa668c476871be57eb7d7a.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5104-132-0x0000000000000000-mapping.dmp