01872bda431e527154fcb97c2272920e21b8ae9d5262dab969ee22d924d64935 | Triage

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-en-20211208
submitted
01-02-2022 10:04

Sharing

Report Analysis Logs

General

Target

01872bda431e527154fcb97c2272920e21b8ae9d5262dab969ee22d924d64935.dll
Size

139KB
MD5

622356de1a9bacc3af4c4cd9c3eee62c
SHA1

ffebf3b83c881696ae52f44ec7974f2425f17043
SHA256

01872bda431e527154fcb97c2272920e21b8ae9d5262dab969ee22d924d64935
SHA512

6de15ad1bd647d634f41f9c369cf190dd7ec770469593a9023ff339998f87264f78cd4d1ca40196fc1164a2ec8bf2d348b3d221e19d921b483d06c6519f92aa2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1588	1368	rundll32.exe	27
PID 1368 wrote to memory of 1588	1368	rundll32.exe	27
PID 1368 wrote to memory of 1588	1368	rundll32.exe	27
PID 1368 wrote to memory of 1588	1368	rundll32.exe	27
PID 1368 wrote to memory of 1588	1368	rundll32.exe	27
PID 1368 wrote to memory of 1588	1368	rundll32.exe	27
PID 1368 wrote to memory of 1588	1368	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01872bda431e527154fcb97c2272920e21b8ae9d5262dab969ee22d924d64935.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01872bda431e527154fcb97c2272920e21b8ae9d5262dab969ee22d924d64935.dll,#1
  2⤵
  PID:1588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1588-55-0x0000000076371000-0x0000000076373000-memory.dmp

Filesize
8KB

Download