3810d9472973ebfc636f39c290dd4ba21aa87beb926aab38b967ae3299518a81 | Triage

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30-03-2023 09:32

Sharing

Report Analysis Logs

General

Target

dbghelp.dll
Size

1.2MB
MD5

4003e34416ebd25e4c115d49dc15e1a7
SHA1

faf95ec65cde5bd833ce610bb8523363310ec4ad
SHA256

c06430b8cb025be506be50a756488e1bcc3827c4f45158d93e4e3eeb98ce1e4f
SHA512

88f5d417377cd62bde417640a79b6ac493e80f0c8b1f63a99378a2a67695ef8e4a541cedb91acfa296ed608e821fee466983806f0d082ed2e74b0cd93eb4fb84
SSDEEP

24576:9AkmijauMug/iyFzb2DfsPV8A4C2vNI1cPdf8xZLGNfav9T:9WiOuRg/iyFzb2QN83XfeYaZ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2676 wrote to memory of 4316	2676	rundll32.exe	rundll32.exe
PID 2676 wrote to memory of 4316	2676	rundll32.exe	rundll32.exe
PID 2676 wrote to memory of 4316	2676	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbghelp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2676

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbghelp.dll,#1
2⤵
PID:4316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...