bce77d91ff59b5bfe613365aa5ede0060f14b7a5109913925dfff79ee18b5721 | Triage

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-en-20211208
submitted
01-02-2022 09:59

Sharing

Report Analysis Logs

General

Target

bce77d91ff59b5bfe613365aa5ede0060f14b7a5109913925dfff79ee18b5721.dll
Size

136KB
MD5

2aa1884341376797f23e02e7f1e78a8b
SHA1

154b6eaa03b622f0ddd3b6899f484b0c9cd3551a
SHA256

bce77d91ff59b5bfe613365aa5ede0060f14b7a5109913925dfff79ee18b5721
SHA512

7a258a9fce8213f7bd952c893c81263a006e39ed19e821fe286c31c58e9d3bcbb2df166bdc6e41ccefe4cff1ab045e0fe2bd4e96e1bcaee24c0f9587be52b85f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1876	1944	rundll32.exe	27
PID 1944 wrote to memory of 1876	1944	rundll32.exe	27
PID 1944 wrote to memory of 1876	1944	rundll32.exe	27
PID 1944 wrote to memory of 1876	1944	rundll32.exe	27
PID 1944 wrote to memory of 1876	1944	rundll32.exe	27
PID 1944 wrote to memory of 1876	1944	rundll32.exe	27
PID 1944 wrote to memory of 1876	1944	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bce77d91ff59b5bfe613365aa5ede0060f14b7a5109913925dfff79ee18b5721.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bce77d91ff59b5bfe613365aa5ede0060f14b7a5109913925dfff79ee18b5721.dll,#1
  2⤵
  PID:1876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1876-55-0x00000000760F1000-0x00000000760F3000-memory.dmp

Filesize
8KB

Download