Resubmissions

16/12/2021, 09:50

211216-lva8vsbgc2 3

14/12/2021, 07:05

211214-hwjpvafce8 10

Analysis

  • max time kernel
    841s
  • max time network
    841s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    16/12/2021, 09:50

General

  • Target

    15097d2f74343c844eddaf977e411939b5060d9be365ac28b34c2c3d489f0b41.dll

  • Size

    522KB

  • MD5

    84702bd6e798481f81066c1e0671ae03

  • SHA1

    c53a1d8aa4495cb5acf07ddc069153fbecd37a91

  • SHA256

    15097d2f74343c844eddaf977e411939b5060d9be365ac28b34c2c3d489f0b41

  • SHA512

    802b350012e73bb3adbb59492d22db33cff7f67084975eb054f969908cab2826945a01f4086e08f88e176a1da2248b5c852d02d3f086c2a036ccddd286367fb4

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\15097d2f74343c844eddaf977e411939b5060d9be365ac28b34c2c3d489f0b41.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:972
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\15097d2f74343c844eddaf977e411939b5060d9be365ac28b34c2c3d489f0b41.dll,#1
      2⤵
        PID:1272

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1272-56-0x00000000756C1000-0x00000000756C3000-memory.dmp

      Filesize

      8KB

    • memory/1272-57-0x00000000001E0000-0x0000000000266000-memory.dmp

      Filesize

      536KB

    • memory/1272-58-0x0000000000160000-0x0000000000161000-memory.dmp

      Filesize

      4KB

    • memory/1272-59-0x0000000000960000-0x000000000097E000-memory.dmp

      Filesize

      120KB

    • memory/1272-60-0x0000000000960000-0x000000000097E000-memory.dmp

      Filesize

      120KB

    • memory/1272-62-0x0000000000960000-0x000000000097E000-memory.dmp

      Filesize

      120KB

    • memory/1272-61-0x00000000002A0000-0x00000000002BF000-memory.dmp

      Filesize

      124KB