952dac4514cc16fd7574bad24d7e22a1cbcffea9d60771a76f84940a65fbb4f2 | Triage

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-en-20210920
submitted
01/11/2021, 14:48

Sharing

Report Analysis Logs

General

Target

952dac4514cc16fd7574bad24d7e22a1cbcffea9d60771a76f84940a65fbb4f2.dll
Size

319KB
MD5

7a6522414145c7f0876756359e457e70
SHA1

c62cab0942fd4583888f2b5118ebc966693e9cbe
SHA256

952dac4514cc16fd7574bad24d7e22a1cbcffea9d60771a76f84940a65fbb4f2
SHA512

eed03c5b40e9f57a2dbfcf3fcccd0d32439dcabc8ee20444faad2a881d8ac2ecaaa6cec323472e593acafd6a824ba7a1e7d38bba9d108dea03c28aa529333f4b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 1060	700	rundll32.exe	28
PID 700 wrote to memory of 1060	700	rundll32.exe	28
PID 700 wrote to memory of 1060	700	rundll32.exe	28
PID 700 wrote to memory of 1060	700	rundll32.exe	28
PID 700 wrote to memory of 1060	700	rundll32.exe	28
PID 700 wrote to memory of 1060	700	rundll32.exe	28
PID 700 wrote to memory of 1060	700	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\952dac4514cc16fd7574bad24d7e22a1cbcffea9d60771a76f84940a65fbb4f2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\952dac4514cc16fd7574bad24d7e22a1cbcffea9d60771a76f84940a65fbb4f2.dll,#1
  2⤵
  PID:1060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1060-55-0x0000000075331000-0x0000000075333000-memory.dmp

Filesize
8KB

Download