daa70a3c21659eae084f570aaa66fe194d4cbce337815b460c40ab744583c762 | Triage

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-en-20211208
submitted
24-01-2022 00:54

Sharing

Report Analysis Logs

General

Target

daa70a3c21659eae084f570aaa66fe194d4cbce337815b460c40ab744583c762.dll
Size

116KB
MD5

86a99126b534c51795a43eaccb7f4534
SHA1

c53312e01ed58f665838a16a74fdcfb966e7a793
SHA256

daa70a3c21659eae084f570aaa66fe194d4cbce337815b460c40ab744583c762
SHA512

06d4e5bb96ea6d23bb595128663104bc2deaeea390330a29466741c9a92767f8d78c4467f25cb6e74cceef737da8e53a859e9a713552c905aabd7ff7584e0b83

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1620 wrote to memory of 1248	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 1248	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 1248	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 1248	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 1248	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 1248	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 1248	1620	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\daa70a3c21659eae084f570aaa66fe194d4cbce337815b460c40ab744583c762.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\daa70a3c21659eae084f570aaa66fe194d4cbce337815b460c40ab744583c762.dll,#1
2⤵
PID:1248

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1248-55-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download