a2eaa2c1a6efa7ae8a3423e4eb2be9dbfd5e1e9fbe30a5434c2612690695b159 | Triage™

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-en-20211014
submitted
18/11/2021, 21:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ae5951e826faa8eed7f17a8efd17a6d9.dll
Size 474KB
Sample211118-z4fftsfffl
SHA256 a2eaa2c1a6efa7ae8a3423e4eb2be9dbfd5e1e9fbe30a5434c2612690695b159
MD5 ae5951e826faa8eed7f17a8efd17a6d9
SHA1 3e4d8d57c56c8facc4b70c2308b98bbc308504dd
SHA512 061c477859a966658ad8de6bb2f607f33c222f92e4fa7ba2436369623a41e04fb0ef03cdcfd14fb915b2e0aa3b627439671bde550a3e34481c6c1c33477920ad
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 796	1728	rundll32.exe	27
PID 1728 wrote to memory of 796	1728	rundll32.exe	27
PID 1728 wrote to memory of 796	1728	rundll32.exe	27
PID 1728 wrote to memory of 796	1728	rundll32.exe	27
PID 1728 wrote to memory of 796	1728	rundll32.exe	27
PID 1728 wrote to memory of 796	1728	rundll32.exe	27
PID 1728 wrote to memory of 796	1728	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae5951e826faa8eed7f17a8efd17a6d9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae5951e826faa8eed7f17a8efd17a6d9.dll,#1
  2⤵
  PID:796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/796-56-0x00000000764D1000-0x00000000764D3000-memory.dmp

Download