Analysis
-
max time kernel
117s -
max time network
133s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 01:51
Static task
static1
Behavioral task
behavioral1
Sample
7047df7a1efe3c1cecc26445b59ac74fd912c9e77ee01f74d653dd20d5edbd0d.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
7047df7a1efe3c1cecc26445b59ac74fd912c9e77ee01f74d653dd20d5edbd0d.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
7047df7a1efe3c1cecc26445b59ac74fd912c9e77ee01f74d653dd20d5edbd0d.dll
-
Size
161KB
-
MD5
8ff4df6e75d5337a6ad5e7af26ea1bb5
-
SHA1
740dd9d6004d7ac7b5f95c4f9c2cb57378417625
-
SHA256
7047df7a1efe3c1cecc26445b59ac74fd912c9e77ee01f74d653dd20d5edbd0d
-
SHA512
7ddb52565142e7b1906c2dcd3deebcdd1e8d8878ad84ab5054870072a2fc1fc1b42860125f28134ec0f7abc207d9a82fe5608039591f91fa624af28b9a5bf1ab
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1552 wrote to memory of 1536 1552 rundll32.exe rundll32.exe PID 1552 wrote to memory of 1536 1552 rundll32.exe rundll32.exe PID 1552 wrote to memory of 1536 1552 rundll32.exe rundll32.exe PID 1552 wrote to memory of 1536 1552 rundll32.exe rundll32.exe PID 1552 wrote to memory of 1536 1552 rundll32.exe rundll32.exe PID 1552 wrote to memory of 1536 1552 rundll32.exe rundll32.exe PID 1552 wrote to memory of 1536 1552 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7047df7a1efe3c1cecc26445b59ac74fd912c9e77ee01f74d653dd20d5edbd0d.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7047df7a1efe3c1cecc26445b59ac74fd912c9e77ee01f74d653dd20d5edbd0d.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1536-55-0x0000000075B11000-0x0000000075B13000-memory.dmpFilesize
8KB
-
memory/1536-58-0x0000000002490000-0x00000000025BD000-memory.dmpFilesize
1.2MB
-
memory/1536-59-0x0000000000250000-0x000000000026F000-memory.dmpFilesize
124KB
-
memory/1536-60-0x0000000003170000-0x0000000003279000-memory.dmpFilesize
1.0MB
-
memory/1536-61-0x0000000000160000-0x000000000016A000-memory.dmpFilesize
40KB
-
memory/1536-62-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/1536-64-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1536-63-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
-
memory/1536-65-0x00000000001E0000-0x00000000001E6000-memory.dmpFilesize
24KB