Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 00:56
Static task
static1
Behavioral task
behavioral1
Sample
d8704d50bc431f536b9f1032c6bae43bbc3505b83da0ba585f10175f93e4f47c.dll
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d8704d50bc431f536b9f1032c6bae43bbc3505b83da0ba585f10175f93e4f47c.dll
Resource
win10-en-20211208
0 signatures
0 seconds
General
-
Target
d8704d50bc431f536b9f1032c6bae43bbc3505b83da0ba585f10175f93e4f47c.dll
-
Size
164KB
-
MD5
2e0d0aaed04118efd3f35aee6246ac1f
-
SHA1
73d6f1534e3a88b3dd0becaf16a450309c57be75
-
SHA256
d8704d50bc431f536b9f1032c6bae43bbc3505b83da0ba585f10175f93e4f47c
-
SHA512
d3c126c38e19cdde8a85e6b61cf432fdcc329a018dc37a8e5725747c871113d43fe2ce5f7cb4765a9321585643b52e9570cac5fb0d9d85b49d41f5f0d486c371
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 756 wrote to memory of 320 756 rundll32.exe rundll32.exe PID 756 wrote to memory of 320 756 rundll32.exe rundll32.exe PID 756 wrote to memory of 320 756 rundll32.exe rundll32.exe PID 756 wrote to memory of 320 756 rundll32.exe rundll32.exe PID 756 wrote to memory of 320 756 rundll32.exe rundll32.exe PID 756 wrote to memory of 320 756 rundll32.exe rundll32.exe PID 756 wrote to memory of 320 756 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d8704d50bc431f536b9f1032c6bae43bbc3505b83da0ba585f10175f93e4f47c.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d8704d50bc431f536b9f1032c6bae43bbc3505b83da0ba585f10175f93e4f47c.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/320-55-0x0000000076071000-0x0000000076073000-memory.dmpFilesize
8KB
-
memory/320-56-0x0000000002A90000-0x0000000002B59000-memory.dmpFilesize
804KB
-
memory/320-58-0x0000000002D10000-0x0000000002E3D000-memory.dmpFilesize
1.2MB
-
memory/320-59-0x00000000002A0000-0x00000000002BF000-memory.dmpFilesize
124KB
-
memory/320-61-0x0000000000160000-0x000000000016A000-memory.dmpFilesize
40KB
-
memory/320-60-0x0000000003100000-0x0000000003209000-memory.dmpFilesize
1.0MB
-
memory/320-63-0x0000000000220000-0x0000000000226000-memory.dmpFilesize
24KB
-
memory/320-62-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB