f93e4c97205e62be08bf62fcd18e7a8a163aa0a04525ba30a364dd2fdd5440c2 | Triage

Analysis

max time kernel
145s
max time network
166s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
13/07/2023, 13:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

F1-2016Import.dll
Size

560KB
MD5

0ec9c838f3f0f2bc32f802cf8583f40b
SHA1

916534d43cc3f05e27d4e91bc5fe58c27fccde01
SHA256

a5bfe238ce5e85e7f4be05ef2e78524dda66a159dc1c0c7c5745678136a220c7
SHA512

e26a2c16f6409d5b716269b0722ea1e2c43b1995534e5040e662663cd8c8426098ecb5a1b72f1056cc5b3817573140f749689c650b168fe5f2a81391dbaa9337
SSDEEP

12288:nsoN02Jo0bwmeFo3diC5H959NTVshjdu8P8aXXKH:sJeomwPFzCB9RTb8lX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 3488	3028	rundll32.exe	70
PID 3028 wrote to memory of 3488	3028	rundll32.exe	70
PID 3028 wrote to memory of 3488	3028	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\F1-2016Import.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\F1-2016Import.dll,#1
  2⤵
  PID:3488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads