317b9d462ec70a5fee52a5ed96674aca292e8e06b2f6301cc36f7a9260f2e832 | Triage

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-en-20211208
submitted
28-01-2022 21:42

Sharing

Report Analysis Logs

General

Target

12.dll
Size

10.0MB
MD5

07a74d45ef7b6d7e86a8fb6aa47ac0fc
SHA1

dccaf17673d0bddf56f2ac98b9ea3a7265895977
SHA256

c8d626c05ba0de1684b6d311ca3541c1e4539b45e97fea3303f95b378447de74
SHA512

ccac308da37bf9183ade459ab41ba7d901c185bd9bc0c45707c93ccde6516fa3fb2e8f311f40e1d6eb83818951210261a7b215780b52e858ab29076b77082cfd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1620	1672	rundll32.exe	27
PID 1672 wrote to memory of 1620	1672	rundll32.exe	27
PID 1672 wrote to memory of 1620	1672	rundll32.exe	27
PID 1672 wrote to memory of 1620	1672	rundll32.exe	27
PID 1672 wrote to memory of 1620	1672	rundll32.exe	27
PID 1672 wrote to memory of 1620	1672	rundll32.exe	27
PID 1672 wrote to memory of 1620	1672	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\12.dll,#1
  2⤵
  PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-55-0x0000000076641000-0x0000000076643000-memory.dmp

Filesize
8KB

Download