3cb2d07f61fad85620e2a95cd3270485217dcfd12d24639aa2ec52cfdd582576 | Triage

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-en-20211208
submitted
01-02-2022 10:02

Sharing

Report Analysis Logs

General

Target

3cb2d07f61fad85620e2a95cd3270485217dcfd12d24639aa2ec52cfdd582576.dll
Size

136KB
MD5

15deecda6809c98503e7936ee9ae61d6
SHA1

30b0ae7df7747ba7fe3a558f0b879effdfa9a15a
SHA256

3cb2d07f61fad85620e2a95cd3270485217dcfd12d24639aa2ec52cfdd582576
SHA512

b20bfbf58b26cd72c3e4e5a66b2d85926ea002558dac341d83e4e7f5f6f4396b2e115f49fe0b8e39fd1b0f8a18fc93151fffcec4902bd4d0d582b2f6400b648a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 1616	1624	rundll32.exe	27
PID 1624 wrote to memory of 1616	1624	rundll32.exe	27
PID 1624 wrote to memory of 1616	1624	rundll32.exe	27
PID 1624 wrote to memory of 1616	1624	rundll32.exe	27
PID 1624 wrote to memory of 1616	1624	rundll32.exe	27
PID 1624 wrote to memory of 1616	1624	rundll32.exe	27
PID 1624 wrote to memory of 1616	1624	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cb2d07f61fad85620e2a95cd3270485217dcfd12d24639aa2ec52cfdd582576.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cb2d07f61fad85620e2a95cd3270485217dcfd12d24639aa2ec52cfdd582576.dll,#1
  2⤵
  PID:1616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1616-55-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Filesize
8KB

Download