Analysis
-
max time kernel
117s -
max time network
141s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 02:07
Static task
static1
Behavioral task
behavioral1
Sample
4ea8baeff8d9091ac367538825bad248c92a2be687e2bb4d008757e074e249d9.dll
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4ea8baeff8d9091ac367538825bad248c92a2be687e2bb4d008757e074e249d9.dll
Resource
win10-en-20211208
0 signatures
0 seconds
General
-
Target
4ea8baeff8d9091ac367538825bad248c92a2be687e2bb4d008757e074e249d9.dll
-
Size
164KB
-
MD5
75eabea8cf7f0b68e4e9183bdbf423c4
-
SHA1
51b0a77a07561a628327895033ebcd8394b1190e
-
SHA256
4ea8baeff8d9091ac367538825bad248c92a2be687e2bb4d008757e074e249d9
-
SHA512
042fe3304d5c78b688c705227adf520c55b0eb5ee75e53b6b86d0b462544788e19da355d79114b9fa67d29cd5377dbfa3802c7d2e00a4e15b0f97e9c27e88c0a
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1876 wrote to memory of 1084 1876 rundll32.exe rundll32.exe PID 1876 wrote to memory of 1084 1876 rundll32.exe rundll32.exe PID 1876 wrote to memory of 1084 1876 rundll32.exe rundll32.exe PID 1876 wrote to memory of 1084 1876 rundll32.exe rundll32.exe PID 1876 wrote to memory of 1084 1876 rundll32.exe rundll32.exe PID 1876 wrote to memory of 1084 1876 rundll32.exe rundll32.exe PID 1876 wrote to memory of 1084 1876 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ea8baeff8d9091ac367538825bad248c92a2be687e2bb4d008757e074e249d9.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ea8baeff8d9091ac367538825bad248c92a2be687e2bb4d008757e074e249d9.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1084-54-0x0000000076121000-0x0000000076123000-memory.dmpFilesize
8KB
-
memory/1084-56-0x0000000002CB0000-0x0000000002D4F000-memory.dmpFilesize
636KB
-
memory/1084-58-0x00000000001E0000-0x00000000001EA000-memory.dmpFilesize
40KB
-
memory/1084-59-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1084-60-0x0000000000660000-0x0000000000661000-memory.dmpFilesize
4KB
-
memory/1084-61-0x0000000000670000-0x0000000000671000-memory.dmpFilesize
4KB
-
memory/1084-57-0x0000000002D50000-0x0000000002E7D000-memory.dmpFilesize
1.2MB
-
memory/1084-62-0x00000000006B0000-0x00000000006CF000-memory.dmpFilesize
124KB
-
memory/1084-64-0x0000000000680000-0x0000000000686000-memory.dmpFilesize
24KB
-
memory/1084-63-0x0000000003190000-0x0000000003299000-memory.dmpFilesize
1.0MB