d6a03147f604ae48a997db148545558f37a15c1ca3475bff2dc2d4f6174f0d07 | Triage

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-en-20211208
submitted
24-01-2022 00:57

Sharing

Report Analysis Logs

General

Target

d6a03147f604ae48a997db148545558f37a15c1ca3475bff2dc2d4f6174f0d07.dll
Size

166KB
MD5

c25d91af0771120c24a50f17f0585e1a
SHA1

45a033887079cc562d41baa1a81262d77cbb9137
SHA256

d6a03147f604ae48a997db148545558f37a15c1ca3475bff2dc2d4f6174f0d07
SHA512

2861593b6b721de01af5bb9e2c69f895d374ffc0a7a0be94cb93a08786b92b95ca9190de0a25409cd53eee6996132ec5138d5fe06481e8c939ce700e12c01397

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1156 wrote to memory of 648	1156	rundll32.exe	rundll32.exe
PID 1156 wrote to memory of 648	1156	rundll32.exe	rundll32.exe
PID 1156 wrote to memory of 648	1156	rundll32.exe	rundll32.exe
PID 1156 wrote to memory of 648	1156	rundll32.exe	rundll32.exe
PID 1156 wrote to memory of 648	1156	rundll32.exe	rundll32.exe
PID 1156 wrote to memory of 648	1156	rundll32.exe	rundll32.exe
PID 1156 wrote to memory of 648	1156	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6a03147f604ae48a997db148545558f37a15c1ca3475bff2dc2d4f6174f0d07.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1156

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6a03147f604ae48a997db148545558f37a15c1ca3475bff2dc2d4f6174f0d07.dll,#1
2⤵
PID:648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-54-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Filesize
8KB

Download