79036368e6229fa1c4eb724a34e4d10973feaa85628058f4ac1eaac6c1fcf19c | Triage™

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-en-20211104
submitted
25/11/2021, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
15239e7be7ce6bfaf0681eb66bcde356.dll
Size 470KB
Sample211125-erecsaecbk
SHA256 79036368e6229fa1c4eb724a34e4d10973feaa85628058f4ac1eaac6c1fcf19c
MD5 15239e7be7ce6bfaf0681eb66bcde356
SHA1 55dc2a27f408bf6437224ecfc62cc01a3311ec08
SHA512 366168368edc0dae19f071431deb1b5a8a9141179ebf84623e8053a00915dc69ec941273658a6c2a94f897f2fc053767774a310ccf4964d3e37d545ab1ad93fa
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 652	1184	rundll32.exe	28
PID 1184 wrote to memory of 652	1184	rundll32.exe	28
PID 1184 wrote to memory of 652	1184	rundll32.exe	28
PID 1184 wrote to memory of 652	1184	rundll32.exe	28
PID 1184 wrote to memory of 652	1184	rundll32.exe	28
PID 1184 wrote to memory of 652	1184	rundll32.exe	28
PID 1184 wrote to memory of 652	1184	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\15239e7be7ce6bfaf0681eb66bcde356.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\15239e7be7ce6bfaf0681eb66bcde356.dll,#1
  2⤵
  PID:652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/652-56-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download