50b3a811481295d5a9f00df228a89eb6bb56d99e313ba1fcfa4e1f606975cbc5 | Triage

Analysis

max time kernel
69s
max time network
23s
platform
windows7_x64
resource
win7-en-20210920
submitted
24/09/2021, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Datop/test2.test.dll
Size

297KB
MD5

be3f95b2ff9a56376525fa48c9db1553
SHA1

f3db37da2369b083f8828bc8ba5ac4c7232983d4
SHA256

868246c1861a22c681d47fdc102215a9c9f7551985f6abcbfb7b983f1cffadbe
SHA512

2ea4b718f870d509c5e2b51954fefe4e916f705f7820963e37e14f7285612beca2c78181a9ba016855d08c74b51ef5d002d0da79b9dde0a82dccc1a83f67e59f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1236	1776	rundll32.exe	27
PID 1776 wrote to memory of 1236	1776	rundll32.exe	27
PID 1776 wrote to memory of 1236	1776	rundll32.exe	27
PID 1776 wrote to memory of 1236	1776	rundll32.exe	27
PID 1776 wrote to memory of 1236	1776	rundll32.exe	27
PID 1776 wrote to memory of 1236	1776	rundll32.exe	27
PID 1776 wrote to memory of 1236	1776	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Datop\test2.test.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Datop\test2.test.dll,#1
  2⤵
  PID:1236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1236-55-0x0000000076851000-0x0000000076853000-memory.dmp

Filesize
8KB

Download