Analysis
-
max time kernel
118s -
max time network
129s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 09:49
Behavioral task
behavioral1
Sample
90a75fcaa0c8da7865da027c84793cdfdef64d26d3ac7172ea8bbce2e63f4c15.dll
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
90a75fcaa0c8da7865da027c84793cdfdef64d26d3ac7172ea8bbce2e63f4c15.dll
Resource
win10v2004-en-20220112
0 signatures
0 seconds
General
-
Target
90a75fcaa0c8da7865da027c84793cdfdef64d26d3ac7172ea8bbce2e63f4c15.dll
-
Size
146KB
-
MD5
9b14a37463b58a73d05d34adf8003ef7
-
SHA1
71b3581a17acc5112c4a9fcc9957ca0bdd54ab8a
-
SHA256
90a75fcaa0c8da7865da027c84793cdfdef64d26d3ac7172ea8bbce2e63f4c15
-
SHA512
462bb96e9359e4dec8814ec8ec8d6f96cc56f6804c488eb26a7e183e22d56f9fa97705e6ac3dba7cf9dee30da1e3326aef31be1087ba805bfe3dd77f6ba038c9
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1972 wrote to memory of 1316 1972 rundll32.exe rundll32.exe PID 1972 wrote to memory of 1316 1972 rundll32.exe rundll32.exe PID 1972 wrote to memory of 1316 1972 rundll32.exe rundll32.exe PID 1972 wrote to memory of 1316 1972 rundll32.exe rundll32.exe PID 1972 wrote to memory of 1316 1972 rundll32.exe rundll32.exe PID 1972 wrote to memory of 1316 1972 rundll32.exe rundll32.exe PID 1972 wrote to memory of 1316 1972 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\90a75fcaa0c8da7865da027c84793cdfdef64d26d3ac7172ea8bbce2e63f4c15.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\90a75fcaa0c8da7865da027c84793cdfdef64d26d3ac7172ea8bbce2e63f4c15.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1316-54-0x0000000074B21000-0x0000000074B23000-memory.dmpFilesize
8KB