8cff08be15157f0d8820253b06eb2e59b37a05668c4ee1507abc1e613710959c | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-en-20211208
submitted
28-01-2022 19:44

Sharing

Report Analysis Logs

General

Target

12.dll
Size

10.0MB
MD5

1e831147b9f62a62ff1fcda164a1fcef
SHA1

81a15c51e58f7d9ef4c00e7e28420b1cebeb2a33
SHA256

a89985ef9618bfaace36a65d16ed72038129f4111883f454aea22161341cba18
SHA512

d90dc9db07f2126543a5cfbea968acb8b51769b463fd6bcc6fb99f0a1428066221970b4171cf92c3668025e3b088d7a7a7f945af73f9286dcec69fa9d53fd7f8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 320	1180	rundll32.exe	27
PID 1180 wrote to memory of 320	1180	rundll32.exe	27
PID 1180 wrote to memory of 320	1180	rundll32.exe	27
PID 1180 wrote to memory of 320	1180	rundll32.exe	27
PID 1180 wrote to memory of 320	1180	rundll32.exe	27
PID 1180 wrote to memory of 320	1180	rundll32.exe	27
PID 1180 wrote to memory of 320	1180	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\12.dll,#1
  2⤵
  PID:320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/320-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download