1e2ba5b412c976f206990ff1ea4f0d7467f3adadaefa3ab44f07d71af4d52262 | Triage™

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-en-20211208
submitted
25/01/2022, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1e2ba5b412c976f206990ff1ea4f0d7467f3adadaefa3ab44f07d71af4d52262.dll
Size 301KB
Sample220125-mteekaeed2
SHA256 1e2ba5b412c976f206990ff1ea4f0d7467f3adadaefa3ab44f07d71af4d52262
MD5 c3d6dc41c06570db7a2c19773ef8bbf3
SHA1 822b6558b830afbf041f5b97d533b402cd2b4c29
SHA512 fcd2eb377a29a2808e303f1f454b9dd02a946cd49dfed956c956eaffd75cf766d227a13b745e2a12fb4ca62d442824b55e55bc02dcf05a1622c8cc269b4d9c3d
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1620	1672	rundll32.exe	27
PID 1672 wrote to memory of 1620	1672	rundll32.exe	27
PID 1672 wrote to memory of 1620	1672	rundll32.exe	27
PID 1672 wrote to memory of 1620	1672	rundll32.exe	27
PID 1672 wrote to memory of 1620	1672	rundll32.exe	27
PID 1672 wrote to memory of 1620	1672	rundll32.exe	27
PID 1672 wrote to memory of 1620	1672	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e2ba5b412c976f206990ff1ea4f0d7467f3adadaefa3ab44f07d71af4d52262.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e2ba5b412c976f206990ff1ea4f0d7467f3adadaefa3ab44f07d71af4d52262.dll,#1
  2⤵
  PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-55-0x0000000076641000-0x0000000076643000-memory.dmp

Download