bf81fbbc09954cde0f6883a4f983b8f9623a9e126a242dacf7afeafcd156679d | Triage

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-en-20211208
submitted
16-12-2021 16:12

Sharing

Report Analysis Logs

General

Target

storelib.dll
Size

160KB
MD5

56dd65c393317f224a03a42bf7ac39f2
SHA1

d8921bc17fe0a6b974258f1055f0738b4a7ba8e4
SHA256

e297ad34b4deae7d030aaa0ddd8935675988e0cb2b4e71d481bf57ac05bc66d6
SHA512

ce18b16abe4d89c50cc195e6f801f6ccfe52564bf08eab25f485456c66aa237e382d9ad62c26460d86f66f5a15d1a1640c13cb1f592d416758781e903ab1c302

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 956 wrote to memory of 1156	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 1156	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 1156	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 1156	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 1156	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 1156	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 1156	956	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\storelib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\storelib.dll,#1
2⤵
PID:1156

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1156-54-0x0000000000000000-mapping.dmp

Download
memory/1156-55-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Filesize
8KB

Download