6095f96dd5eca96a3fb9338eec4ab574921c0febb36f6a6db60aae1aeb9ffcab | Triage

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-en-20211014
submitted
13-11-2021 17:36

Sharing

Report Analysis Logs

General

Target

6095f96dd5eca96a3fb9338eec4ab574921c0febb36f6a6db60aae1aeb9ffcab.dll
Size

72KB
MD5

dd6257665f634b5566e15bc62e90c809
SHA1

54ded03f7b82c8aa4de10e673b556d0ba778177d
SHA256

6095f96dd5eca96a3fb9338eec4ab574921c0febb36f6a6db60aae1aeb9ffcab
SHA512

60e6297803141206a2ef9c30c028fb87581205623774e4c43ef4566dd42b61faf8d85fb3ddca2ec516448500dd392c01bdfb781c1bacd38b6c0a04837237eb85

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 1684	1864	rundll32.exe	27
PID 1864 wrote to memory of 1684	1864	rundll32.exe	27
PID 1864 wrote to memory of 1684	1864	rundll32.exe	27
PID 1864 wrote to memory of 1684	1864	rundll32.exe	27
PID 1864 wrote to memory of 1684	1864	rundll32.exe	27
PID 1864 wrote to memory of 1684	1864	rundll32.exe	27
PID 1864 wrote to memory of 1684	1864	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6095f96dd5eca96a3fb9338eec4ab574921c0febb36f6a6db60aae1aeb9ffcab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6095f96dd5eca96a3fb9338eec4ab574921c0febb36f6a6db60aae1aeb9ffcab.dll,#1
  2⤵
  PID:1684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-56-0x0000000075B71000-0x0000000075B73000-memory.dmp

Filesize
8KB

Download