0228591177e23efbc29ea9da223160ea2ac475be440a4c2ccef4263b40e8ad8d | Triage

Resubmissions

30-12-2021 05:18

211230-fzm6bsfee6 1

24-12-2021 11:10

211224-m9tt7achej 10

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-en-20211208
submitted
24-12-2021 11:10

Sharing

Report Analysis Logs

General

Target

0228591177e23efbc29ea9da223160ea2ac475be440a4c2ccef4263b40e8ad8d.bin.dll
Size

5KB
MD5

1eccc0a6f16502e5f7fcb1f44e2225af
SHA1

0e8037b67d8444b1f4c46f598f8e62ba99e2b9fc
SHA256

0228591177e23efbc29ea9da223160ea2ac475be440a4c2ccef4263b40e8ad8d
SHA512

31e96d48b0f6a7ae6ea723dd3ad02dadbc237d15b61dd7ade5904fbfd22494d9d61266041a2f881128f9d439a0a873d09173e02d1104a3e89946710bec86f2b5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1608 wrote to memory of 1308	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 1308	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 1308	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 1308	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 1308	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 1308	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 1308	1608	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0228591177e23efbc29ea9da223160ea2ac475be440a4c2ccef4263b40e8ad8d.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0228591177e23efbc29ea9da223160ea2ac475be440a4c2ccef4263b40e8ad8d.bin.dll,#1
  2⤵
  PID:1308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1308-54-0x0000000000000000-mapping.dmp

Download
memory/1308-55-0x0000000076451000-0x0000000076453000-memory.dmp

Filesize
8KB

Download