1d8efc7665bc83f1d7fe443ef4ce6c52eb4829769de0f7fb890b5b12bbcb92bd | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-en-20211104
submitted
13-11-2021 17:35

Sharing

Report Analysis Logs

General

Target

1d8efc7665bc83f1d7fe443ef4ce6c52eb4829769de0f7fb890b5b12bbcb92bd.dll
Size

50KB
MD5

1cfb3b43089741950a7bb53afc8a6c2f
SHA1

4b4f2e7006287e9fd8177869c00a8cd2be560058
SHA256

1d8efc7665bc83f1d7fe443ef4ce6c52eb4829769de0f7fb890b5b12bbcb92bd
SHA512

182110771383c30b84cd232562f482c837f802e4f71f7f65972c2b91fa481859b23bb9379a5fec4cb04a28fff4ec0414bbf75ec5ba496d5f2857f595dd03541d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 692 wrote to memory of 1036	692	rundll32.exe	28
PID 692 wrote to memory of 1036	692	rundll32.exe	28
PID 692 wrote to memory of 1036	692	rundll32.exe	28
PID 692 wrote to memory of 1036	692	rundll32.exe	28
PID 692 wrote to memory of 1036	692	rundll32.exe	28
PID 692 wrote to memory of 1036	692	rundll32.exe	28
PID 692 wrote to memory of 1036	692	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d8efc7665bc83f1d7fe443ef4ce6c52eb4829769de0f7fb890b5b12bbcb92bd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d8efc7665bc83f1d7fe443ef4ce6c52eb4829769de0f7fb890b5b12bbcb92bd.dll,#1
  2⤵
  PID:1036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1036-56-0x0000000075731000-0x0000000075733000-memory.dmp

Filesize
8KB

Download