b1e703bd4df1d3e85ff97b638357b8c96360c9a658930473d37b733dbed51e02 | Triage

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-en-20211208
submitted
01-02-2022 10:00

Sharing

Report Analysis Logs

General

Target

b1e703bd4df1d3e85ff97b638357b8c96360c9a658930473d37b733dbed51e02.dll
Size

138KB
MD5

fb82ccc8e504fe065fb785e4cfdd440a
SHA1

14e9d68bba7a184863667c680a8d5a757149aa36
SHA256

b1e703bd4df1d3e85ff97b638357b8c96360c9a658930473d37b733dbed51e02
SHA512

d1e50c1bf8cc9e95d55c99085e93dc51655cd4a9f940115f13ddd0c19b9be8e088353adadd261673a33969e7d9b1632376d6106fdaf1f0d2067fad0f8bdf517c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 880	788	rundll32.exe	27
PID 788 wrote to memory of 880	788	rundll32.exe	27
PID 788 wrote to memory of 880	788	rundll32.exe	27
PID 788 wrote to memory of 880	788	rundll32.exe	27
PID 788 wrote to memory of 880	788	rundll32.exe	27
PID 788 wrote to memory of 880	788	rundll32.exe	27
PID 788 wrote to memory of 880	788	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1e703bd4df1d3e85ff97b638357b8c96360c9a658930473d37b733dbed51e02.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1e703bd4df1d3e85ff97b638357b8c96360c9a658930473d37b733dbed51e02.dll,#1
  2⤵
  PID:880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/880-54-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download