Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 09:09
Behavioral task
behavioral1
Sample
d3732cfb3cf320fbafcd332dcf4db90b5d306bf4e16518248a571124599e07cb.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d3732cfb3cf320fbafcd332dcf4db90b5d306bf4e16518248a571124599e07cb.dll
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
d3732cfb3cf320fbafcd332dcf4db90b5d306bf4e16518248a571124599e07cb.dll
-
Size
42KB
-
MD5
e925c5008b817fab066c50aad00eadfb
-
SHA1
8b160a12a9709770bdea5a527bb7d1f209c26f1a
-
SHA256
d3732cfb3cf320fbafcd332dcf4db90b5d306bf4e16518248a571124599e07cb
-
SHA512
3123db29fbe8a9150aa84a46a9b6cbf7e2dc5e85339facbd5d666ce4cd58e2dea0abf1aff57bd3b3023a210405c17e322e1dfead79da1693e4aec618d6b8e732
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1816 wrote to memory of 1972 1816 rundll32.exe rundll32.exe PID 1816 wrote to memory of 1972 1816 rundll32.exe rundll32.exe PID 1816 wrote to memory of 1972 1816 rundll32.exe rundll32.exe PID 1816 wrote to memory of 1972 1816 rundll32.exe rundll32.exe PID 1816 wrote to memory of 1972 1816 rundll32.exe rundll32.exe PID 1816 wrote to memory of 1972 1816 rundll32.exe rundll32.exe PID 1816 wrote to memory of 1972 1816 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d3732cfb3cf320fbafcd332dcf4db90b5d306bf4e16518248a571124599e07cb.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d3732cfb3cf320fbafcd332dcf4db90b5d306bf4e16518248a571124599e07cb.dll,#12⤵PID:1972
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1972-55-0x0000000074B21000-0x0000000074B23000-memory.dmpFilesize
8KB