e32899bef78f6af4a155f738298e042f72fe5e643ec934f8778180f71e511727 | Triage

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-en-20211208
submitted
24-12-2021 11:10

Sharing

Report Analysis Logs

General

Target

e32899bef78f6af4a155f738298e042f72fe5e643ec934f8778180f71e511727.bin.dll
Size

5KB
MD5

8ae40c8418b2c36b58d2a43153544ddd
SHA1

c5cc49b7b2cb30d19fa8fd7abff3a04d456f4b94
SHA256

e32899bef78f6af4a155f738298e042f72fe5e643ec934f8778180f71e511727
SHA512

5b24f2fba4d5a25c6cfa8d1a422426c2c43a4032ecc2707bbdaf0d42deef48df95bbce2d12e0423c3569c5c8974a2c3b3a5fa39e86ffcac3372298de8e0304bb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 1776	1624	rundll32.exe	27
PID 1624 wrote to memory of 1776	1624	rundll32.exe	27
PID 1624 wrote to memory of 1776	1624	rundll32.exe	27
PID 1624 wrote to memory of 1776	1624	rundll32.exe	27
PID 1624 wrote to memory of 1776	1624	rundll32.exe	27
PID 1624 wrote to memory of 1776	1624	rundll32.exe	27
PID 1624 wrote to memory of 1776	1624	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e32899bef78f6af4a155f738298e042f72fe5e643ec934f8778180f71e511727.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e32899bef78f6af4a155f738298e042f72fe5e643ec934f8778180f71e511727.bin.dll,#1
  2⤵
  PID:1776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1776-55-0x0000000076C61000-0x0000000076C63000-memory.dmp

Filesize
8KB

Download