bc1429bf4af71b89c060feaa6eff695e579818da77d15c271b20f603222bb688 | Triage

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-en-20211208
submitted
01-02-2022 09:59

Sharing

Report Analysis Logs

General

Target

bc1429bf4af71b89c060feaa6eff695e579818da77d15c271b20f603222bb688.dll
Size

135KB
MD5

518d60555589b60095fc393b3f680555
SHA1

0223b5cd97a941579381690a5c5ae4b2ee435271
SHA256

bc1429bf4af71b89c060feaa6eff695e579818da77d15c271b20f603222bb688
SHA512

2eee3ac7a25efa739f5de56cf734be5f740f21fd62de3bfc4b3b4cc8cc814ee74ef602fe0d124772cda4db88526ff7da0652480ee2d7cc348b7651e688158d70

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 788	732	rundll32.exe	27
PID 732 wrote to memory of 788	732	rundll32.exe	27
PID 732 wrote to memory of 788	732	rundll32.exe	27
PID 732 wrote to memory of 788	732	rundll32.exe	27
PID 732 wrote to memory of 788	732	rundll32.exe	27
PID 732 wrote to memory of 788	732	rundll32.exe	27
PID 732 wrote to memory of 788	732	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc1429bf4af71b89c060feaa6eff695e579818da77d15c271b20f603222bb688.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc1429bf4af71b89c060feaa6eff695e579818da77d15c271b20f603222bb688.dll,#1
  2⤵
  PID:788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/788-55-0x0000000076B81000-0x0000000076B83000-memory.dmp

Filesize
8KB

Download