Analysis
-
max time kernel
121s -
max time network
139s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 02:20
Static task
static1
Behavioral task
behavioral1
Sample
2fa7b5a60cd1a8b67b09a13e09529fe399d2f3f62c5591badaccf5d3a052289f.dll
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2fa7b5a60cd1a8b67b09a13e09529fe399d2f3f62c5591badaccf5d3a052289f.dll
Resource
win10-en-20211208
0 signatures
0 seconds
General
-
Target
2fa7b5a60cd1a8b67b09a13e09529fe399d2f3f62c5591badaccf5d3a052289f.dll
-
Size
164KB
-
MD5
5fa2e3adcd15792d66654130fcf47744
-
SHA1
1df8a5fb27139fb5ca5cf0f5921e4e9808ee97a1
-
SHA256
2fa7b5a60cd1a8b67b09a13e09529fe399d2f3f62c5591badaccf5d3a052289f
-
SHA512
41ddd0647a56174e9953322236892a4b6db133503bf6421b6dcfa24f103f584be0e6000fe574e69293468b72e4191bd95a18dbaa9add6fc11ce20b022c0aa37e
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1180 wrote to memory of 1796 1180 rundll32.exe rundll32.exe PID 1180 wrote to memory of 1796 1180 rundll32.exe rundll32.exe PID 1180 wrote to memory of 1796 1180 rundll32.exe rundll32.exe PID 1180 wrote to memory of 1796 1180 rundll32.exe rundll32.exe PID 1180 wrote to memory of 1796 1180 rundll32.exe rundll32.exe PID 1180 wrote to memory of 1796 1180 rundll32.exe rundll32.exe PID 1180 wrote to memory of 1796 1180 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2fa7b5a60cd1a8b67b09a13e09529fe399d2f3f62c5591badaccf5d3a052289f.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2fa7b5a60cd1a8b67b09a13e09529fe399d2f3f62c5591badaccf5d3a052289f.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1796-55-0x0000000075831000-0x0000000075833000-memory.dmpFilesize
8KB
-
memory/1796-57-0x00000000000B0000-0x00000000000BA000-memory.dmpFilesize
40KB
-
memory/1796-58-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/1796-60-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/1796-59-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/1796-62-0x00000000030F0000-0x000000000321D000-memory.dmpFilesize
1.2MB
-
memory/1796-63-0x0000000000350000-0x000000000036F000-memory.dmpFilesize
124KB
-
memory/1796-64-0x0000000000220000-0x0000000000226000-memory.dmpFilesize
24KB
-
memory/1796-65-0x0000000003410000-0x0000000003519000-memory.dmpFilesize
1.0MB