5c1eeca485650a1c9d3fc9ba7848ad3be1f64be2776c7487f046eca22bb1fb35 | Triage

Resubmissions

09-12-2022 21:31

221209-1c8tqsed62 10

01-12-2022 19:44

221201-yf4yvaeb95 10

Analysis

max time kernel
228s
max time network
495s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2022 21:31

Sharing

Report Analysis Logs

General

Target

48.dll
Size

600KB
MD5

5f2f64254193b3e46ad38110af70c191
SHA1

3c390a854b4bed296d549288e42ab9388a39b42b
SHA256

cff751c5dc8d9914b185064dd21cbbac5db7768cab5be0eab6bc2ac958559ef6
SHA512

708d894742bc1cb1c1f855771d364f4a1388aa0abdd920767330509bea6977d2e9c8efab4ba25e60ad61f6320b42840f207d7e25b68e803cc57f28809d35cd2b
SSDEEP

12288:QSUUEfo5I6/o2qgkpUdG9Msme0CWUdOWk4F:QSTiWDvLmRme0C0Wk4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2340 wrote to memory of 5068	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 5068	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 5068	2340	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\48.dll,#1
  2⤵
  PID:5068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5068-132-0x0000000000000000-mapping.dmp

Download