7bd7f5ba852aa4c2ec1bc0cdf48920529669604be9770c35d0965da98105a0f2 | Triage

Analysis

max time kernel
123s
max time network
123s
platform
windows7_x64
resource
win7-en-20211208
submitted
28-01-2022 20:06

Sharing

Report Analysis Logs

General

Target

12.dll
Size

10.0MB
MD5

e41e2c762828167b15c34131d6fbc65e
SHA1

fa358fab5e5e045443f84a73deaf90bb181b4a14
SHA256

a01c2093060ea46bb6879f0aaf091926cba71f8b8591307a4c6d8885018e401e
SHA512

56b7e6ff72bd92adea83d7681b5d35424f71a131dbe7ac4442dc7d260af2bf9c71c1f132b2f812792b9c8c1b0db6f7bcc075e915927f774dd831f5db39039806

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1968	1668	rundll32.exe	27
PID 1668 wrote to memory of 1968	1668	rundll32.exe	27
PID 1668 wrote to memory of 1968	1668	rundll32.exe	27
PID 1668 wrote to memory of 1968	1668	rundll32.exe	27
PID 1668 wrote to memory of 1968	1668	rundll32.exe	27
PID 1668 wrote to memory of 1968	1668	rundll32.exe	27
PID 1668 wrote to memory of 1968	1668	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\12.dll,#1
  2⤵
  PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-54-0x0000000075431000-0x0000000075433000-memory.dmp

Filesize
8KB

Download