e3b914657f8c1ab8a02fe4dfc040ed90a79683a7317cc7a499089247aa7f646d | Triage

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2023 18:55

Sharing

Report Analysis Logs

General

Target

04277099.dll
Size

1.1MB
MD5

9525e5786e95d8805ae4d98a2f2e7ee4
SHA1

36c906e3d14a17eb3acb3715929baa5a01a62768
SHA256

e3b914657f8c1ab8a02fe4dfc040ed90a79683a7317cc7a499089247aa7f646d
SHA512

39a6ede1e75f58136aad22d87b4caf7e32fbe0fc37778eeda9461a14364cc7f5809cf78faa6f9f908ad2bd2f971e5d6d5bdf8bf239697b56b3676b3c7bdffdfd
SSDEEP

24576:XCsQeoZ2Jpt6/yPllX/vZe/IlaJdjKT172O74RJugoSg1Iak:Xz6/ytp/xonJdE7R4RJugol1Iak

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

Processes:

rundll32.exe

flow	pid	process
10	4644	rundll32.exe
14	4644	rundll32.exe
19	4644	rundll32.exe
20	4644	rundll32.exe
21	4644	rundll32.exe
31	4644	rundll32.exe
32	4644	rundll32.exe
35	4644	rundll32.exe
36	4644	rundll32.exe
37	4644	rundll32.exe
38	4644	rundll32.exe
39	4644	rundll32.exe
40	4644	rundll32.exe
41	4644	rundll32.exe
42	4644	rundll32.exe
43	4644	rundll32.exe
44	4644	rundll32.exe
45	4644	rundll32.exe
46	4644	rundll32.exe
47	4644	rundll32.exe
48	4644	rundll32.exe
53	4644	rundll32.exe
54	4644	rundll32.exe
63	4644	rundll32.exe
64	4644	rundll32.exe
66	4644	rundll32.exe
68	4644	rundll32.exe
75	4644	rundll32.exe
76	4644	rundll32.exe
78	4644	rundll32.exe
79	4644	rundll32.exe
80	4644	rundll32.exe
81	4644	rundll32.exe
84	4644	rundll32.exe
85	4644	rundll32.exe
87	4644	rundll32.exe
88	4644	rundll32.exe
93	4644	rundll32.exe
94	4644	rundll32.exe
97	4644	rundll32.exe
98	4644	rundll32.exe
99	4644	rundll32.exe
100	4644	rundll32.exe
102	4644	rundll32.exe
103	4644	rundll32.exe
104	4644	rundll32.exe
105	4644	rundll32.exe
106	4644	rundll32.exe
107	4644	rundll32.exe
108	4644	rundll32.exe
109	4644	rundll32.exe
111	4644	rundll32.exe
112	4644	rundll32.exe
113	4644	rundll32.exe
114	4644	rundll32.exe
115	4644	rundll32.exe
116	4644	rundll32.exe
117	4644	rundll32.exe
118	4644	rundll32.exe
120	4644	rundll32.exe
121	4644	rundll32.exe
122	4644	rundll32.exe
123	4644	rundll32.exe
124	4644	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3052 wrote to memory of 4644	3052	rundll32.exe	rundll32.exe
PID 3052 wrote to memory of 4644	3052	rundll32.exe	rundll32.exe
PID 3052 wrote to memory of 4644	3052	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04277099.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3052

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04277099.dll,#1
2⤵
- Blocklisted process makes network request
PID:4644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LZ0AI98S\33JQLFED.htm
Filesize
377KB

MD5
7be6a5906479b95b648a38af901af7eb

SHA1
bc86ac0d2d6bcdcfbf80f15a96309cc7f7d59b28

SHA256
04357922d5e45c3a7cf8d512f641f4708884c970635ddc6c0660ff85f007f720

SHA512
498379e5c503f0884f97cba9cca0c37974955e3522823744ce61623598a02c91f21674f401419550e201c5f3bbbb4f6e3b0d5c98f9fe2bc1e6d8e6c181cf55e7

Download Submit