74f9023b2e303fd7e7f11c9988115579add15c40a6ed07b9bf67182bc02918eb | Triage

Resubmissions

09-12-2022 15:07

221209-shr46sgc6z 1

09-12-2022 07:44

221209-jk35safe7s 10

Analysis

max time kernel
171s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2022 07:44

Sharing

Report Analysis Logs

General

Target

194.dll
Size

600KB
MD5

4921489da5dabe49feb8b1d4951e4e8a
SHA1

29c6a5278101828ff9ec9b4cb65b47509715c8ef
SHA256

1b786901f5ade0d0b869c545170270a94999f3f925a0029f3fe6308a803d66bf
SHA512

f550f4453e093cadcf5d00492132cb168b82c5e182c6e11d48e1103908b609e4c284d9faefa4af407478629d59fd26332269d161a7a57d04142491abbfb3d3b5
SSDEEP

12288:QSUUEfo5I6/o2qgkpUdc9Msme0CWUdOWk4F:QSTiWDvL8Rme0C0Wk4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4664 wrote to memory of 4628	4664	rundll32.exe	rundll32.exe
PID 4664 wrote to memory of 4628	4664	rundll32.exe	rundll32.exe
PID 4664 wrote to memory of 4628	4664	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\194.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4664

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\194.dll,#1
2⤵
PID:4628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4628-132-0x0000000000000000-mapping.dmp

Download