dddc57299857e6ecb2b80cbab2ae6f1978e89c4bfe664c7607129b0fc8db8b1f | Triage™

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-en-20211014
submitted
03/11/2021, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dddc57299857e6ecb2b80cbab2ae6f1978e89c4bfe664c7607129b0fc8db8b1f.dll
Size 1.2MB
Sample211103-pgmaradga6
SHA256 dddc57299857e6ecb2b80cbab2ae6f1978e89c4bfe664c7607129b0fc8db8b1f
MD5 2c143271dc4e8da1d3f94bb15df49ab3
SHA1 f437544e14ac6389806fdee8a4ea335b3d7dfe2f
SHA512 83f5126a1cf9fe91f11b2a4ca2c173830dd331f47009348ec27481d2c4c2d8f49e1a96b05f2b03e343c977f7ab7508afaf42d5b637decda8adbcb9b28814716d
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 1728	948	rundll32.exe	27
PID 948 wrote to memory of 1728	948	rundll32.exe	27
PID 948 wrote to memory of 1728	948	rundll32.exe	27
PID 948 wrote to memory of 1728	948	rundll32.exe	27
PID 948 wrote to memory of 1728	948	rundll32.exe	27
PID 948 wrote to memory of 1728	948	rundll32.exe	27
PID 948 wrote to memory of 1728	948	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dddc57299857e6ecb2b80cbab2ae6f1978e89c4bfe664c7607129b0fc8db8b1f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dddc57299857e6ecb2b80cbab2ae6f1978e89c4bfe664c7607129b0fc8db8b1f.dll,#1
  2⤵
  PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1728-56-0x00000000764D1000-0x00000000764D3000-memory.dmp

Download