Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 01:17
Static task
static1
Behavioral task
behavioral1
Sample
b10cc7b88d7a76bbb5f22fd3cad50e351c902e1d16daaf9135f44b9571e533eb.dll
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b10cc7b88d7a76bbb5f22fd3cad50e351c902e1d16daaf9135f44b9571e533eb.dll
Resource
win10-en-20211208
0 signatures
0 seconds
General
-
Target
b10cc7b88d7a76bbb5f22fd3cad50e351c902e1d16daaf9135f44b9571e533eb.dll
-
Size
164KB
-
MD5
f8663767268e48d6bd4591772463120c
-
SHA1
5acfd215ddfe0e23d9b7ca4d0cf058d0c2af3a8c
-
SHA256
b10cc7b88d7a76bbb5f22fd3cad50e351c902e1d16daaf9135f44b9571e533eb
-
SHA512
caec157bea4fd5063f510cb34019c6379114f70aea8da690dbb1aefe06b4fe05b367bb67027ab2c2a18f2db0fe8c700280af1f571cd0c41d88a101923b323345
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1616 wrote to memory of 1268 1616 rundll32.exe rundll32.exe PID 1616 wrote to memory of 1268 1616 rundll32.exe rundll32.exe PID 1616 wrote to memory of 1268 1616 rundll32.exe rundll32.exe PID 1616 wrote to memory of 1268 1616 rundll32.exe rundll32.exe PID 1616 wrote to memory of 1268 1616 rundll32.exe rundll32.exe PID 1616 wrote to memory of 1268 1616 rundll32.exe rundll32.exe PID 1616 wrote to memory of 1268 1616 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b10cc7b88d7a76bbb5f22fd3cad50e351c902e1d16daaf9135f44b9571e533eb.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b10cc7b88d7a76bbb5f22fd3cad50e351c902e1d16daaf9135f44b9571e533eb.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1268-55-0x0000000075F81000-0x0000000075F83000-memory.dmpFilesize
8KB
-
memory/1268-56-0x0000000002BE1000-0x0000000002C63000-memory.dmpFilesize
520KB
-
memory/1268-58-0x00000000000B0000-0x00000000000BA000-memory.dmpFilesize
40KB
-
memory/1268-59-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/1268-60-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/1268-61-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/1268-57-0x0000000002CB0000-0x0000000002D4F000-memory.dmpFilesize
636KB
-
memory/1268-62-0x00000000030A0000-0x00000000031CD000-memory.dmpFilesize
1.2MB
-
memory/1268-63-0x0000000000340000-0x000000000035F000-memory.dmpFilesize
124KB
-
memory/1268-65-0x00000000001A0000-0x00000000001A6000-memory.dmpFilesize
24KB
-
memory/1268-64-0x0000000003480000-0x0000000003589000-memory.dmpFilesize
1.0MB