9f651ae6ea538238748614a7f86fe2b0f76e881d6c38da581f284e4b6f79b0ca | Triage

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-en-20211208
submitted
28-01-2022 13:34

Sharing

Report Analysis Logs

General

Target

PER-DCOMP-Intimacao.dll
Size

182KB
MD5

98e4f5e65acc6362a0ca510a34d8e295
SHA1

b90e44b0b11eaf0a903fda43eb67b0bceab3fced
SHA256

7bb4b6eebd9747127887e6d21ecd3c29cf8ff23795ce0df58ff5e7679d4ddcf0
SHA512

7e4363a7aa2212de1b349ada2b7973dfef66259980f9e67ec3ee146e780eeb0454c4a214b30ca0fd743414232230cbd302ed5f17ce1ac52f8beba5705201cf04

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 740 wrote to memory of 1920	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1920	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1920	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1920	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1920	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1920	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1920	740	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PER-DCOMP-Intimacao.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:740

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PER-DCOMP-Intimacao.dll,#1
2⤵
PID:1920

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1920-54-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download