9f651ae6ea538238748614a7f86fe2b0f76e881d6c38da581f284e4b6f79b0ca | Triage

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-en-20211208
submitted
28-01-2022 13:34

Sharing

Report Analysis Logs

General

Target

01/2015.5.27/15.dll
Size

78KB
MD5

e42f5dbf5678f4a9020798f584f6b008
SHA1

3aee531ae558fb08103735dfc9aeaa81d768212a
SHA256

23ba4ddbe999f329582bff188778d1e27db1e8182899308c77a077f087878a2a
SHA512

196bd228eb1458e2105802424b7c900c2b35b578ee8cfa220d073ca07f8c06f1fdfa4294ce7208ddd1030109f87311e8898f591f8cd5a9ac5b9fec6c05a971d1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1756 wrote to memory of 1224	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1224	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1224	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1224	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1224	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1224	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1224	1756	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01\2015.5.27\15.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01\2015.5.27\15.dll,#1
2⤵
PID:1224

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1224-54-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download
memory/1224-55-0x00000000021C0000-0x0000000002384000-memory.dmp

Filesize
1.8MB

Download
memory/1224-57-0x0000000000230000-0x0000000000249000-memory.dmp

Filesize
100KB

Download