Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
31-01-2023 07:55
Static task
static1
Behavioral task
behavioral1
Sample
edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa.dll
-
Size
669KB
-
MD5
550686c0ee48c386dfcb40199bd076ac
-
SHA1
ee5134da4d3efcb466081fb6197be5e12a5b22ab
-
SHA256
edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa
-
SHA512
0b7f47af883b99f9fbdc08020446b58f2f3fa55292fd9bc78fc967dd35bdd8bd549802722de37668cc89ede61b20359190efbfdf026ae2bdc854f4740a54649e
-
SSDEEP
12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1368 wrote to memory of 4320 1368 rundll32.exe rundll32.exe PID 1368 wrote to memory of 4320 1368 rundll32.exe rundll32.exe PID 1368 wrote to memory of 4320 1368 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4320-132-0x0000000000000000-mapping.dmp