Analysis
-
max time kernel
117s -
max time network
164s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 00:47
Static task
static1
Behavioral task
behavioral1
Sample
e902425859251072e8c856657ab2b151f963ab492d7468a13fae24306d62c89d.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e902425859251072e8c856657ab2b151f963ab492d7468a13fae24306d62c89d.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
e902425859251072e8c856657ab2b151f963ab492d7468a13fae24306d62c89d.dll
-
Size
141KB
-
MD5
5bcd0d08709274844e3c855a19ff8124
-
SHA1
e5666d44e0f9b9823b69f40df1064781223ef128
-
SHA256
e902425859251072e8c856657ab2b151f963ab492d7468a13fae24306d62c89d
-
SHA512
c7a705d4259da041aaa2f207c95348f6af5e4f66c2d57012f3ff8df53b83f37608de89291cdfc53c4082eeec63f2064baa71ab195b050d14ef399410a8186056
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 736 wrote to memory of 780 736 rundll32.exe rundll32.exe PID 736 wrote to memory of 780 736 rundll32.exe rundll32.exe PID 736 wrote to memory of 780 736 rundll32.exe rundll32.exe PID 736 wrote to memory of 780 736 rundll32.exe rundll32.exe PID 736 wrote to memory of 780 736 rundll32.exe rundll32.exe PID 736 wrote to memory of 780 736 rundll32.exe rundll32.exe PID 736 wrote to memory of 780 736 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e902425859251072e8c856657ab2b151f963ab492d7468a13fae24306d62c89d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e902425859251072e8c856657ab2b151f963ab492d7468a13fae24306d62c89d.dll,#12⤵PID:780
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/780-55-0x0000000076B81000-0x0000000076B83000-memory.dmpFilesize
8KB