879e6bd86f75b4a92b04789157948aa3bfdbab7de712facbd4dc3659499d8c43 | Triage

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-en-20211208
submitted
24-12-2021 11:10

Sharing

Report Analysis Logs

General

Target

879e6bd86f75b4a92b04789157948aa3bfdbab7de712facbd4dc3659499d8c43.bin.dll
Size

5KB
MD5

8e7f03b83af062a85162c9dd0d54ca65
SHA1

e4d41a4a19b8f0b4b1ea64f4717bb731b5dec91e
SHA256

879e6bd86f75b4a92b04789157948aa3bfdbab7de712facbd4dc3659499d8c43
SHA512

57edae00449c60b0c6a60f32d8679f8051556de86fa3e46ce8c2e933ee272e289f2c9877973a22cb40ab9a0357affbd752f9336d3a31e051013484601336508a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 1700	964	rundll32.exe	27
PID 964 wrote to memory of 1700	964	rundll32.exe	27
PID 964 wrote to memory of 1700	964	rundll32.exe	27
PID 964 wrote to memory of 1700	964	rundll32.exe	27
PID 964 wrote to memory of 1700	964	rundll32.exe	27
PID 964 wrote to memory of 1700	964	rundll32.exe	27
PID 964 wrote to memory of 1700	964	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\879e6bd86f75b4a92b04789157948aa3bfdbab7de712facbd4dc3659499d8c43.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\879e6bd86f75b4a92b04789157948aa3bfdbab7de712facbd4dc3659499d8c43.bin.dll,#1
  2⤵
  PID:1700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1700-56-0x0000000075F91000-0x0000000075F93000-memory.dmp

Filesize
8KB

Download