ad93e037fa69cb66bd757866fd38ed0eab0db89541b4739c302aec7e797f5ec4 | Triage

Analysis

max time kernel
166s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2023 16:50

Sharing

Report Analysis Logs

General

Target

32bit/Plugins/UMAMesh.dll
Size

26KB
MD5

c6695f46c9ba57b183cae349d7b393dd
SHA1

0c8f0e829e0c68ef9a52de38c15bbcdd53972c31
SHA256

ecd989a7e0b2549dd82f7cca9d3f7a492ade4c7ecc735a45eb2ffce4ae598e13
SHA512

884fe51f2bdd7986d0e9ae4696ce69134937e660b3498c63da648548354c004f44c6ef386a29a0ce9dd7ff595adeac392e9c6915cd67ed407587402ff377a1a0
SSDEEP

768:dOgKu1cQSUd4nQMMWFcT3DkVCwOZsOd2:dOgdC5nQMMWFcTzFwOZm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 4472	432	rundll32.exe	80
PID 432 wrote to memory of 4472	432	rundll32.exe	80
PID 432 wrote to memory of 4472	432	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32bit\Plugins\UMAMesh.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32bit\Plugins\UMAMesh.dll,#1
  2⤵
  PID:4472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4472-133-0x0000000000000000-mapping.dmp

Download