e0963a44aad1ef28ffe117fc4d8d779dd2a1a5da2985473efe45b5d65038c270 | Triage

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-en-20211208
submitted
01-02-2022 09:58

Sharing

Report Analysis Logs

General

Target

e0963a44aad1ef28ffe117fc4d8d779dd2a1a5da2985473efe45b5d65038c270.dll
Size

139KB
MD5

dbb4d5df24d46fffba25a87f9d417ab5
SHA1

36dec709d0fdb997c439f9a5fc1409f47b4b4e7c
SHA256

e0963a44aad1ef28ffe117fc4d8d779dd2a1a5da2985473efe45b5d65038c270
SHA512

9c9997e524cb2ba8a566e7f41a8696a391b32dde403369f6952e0a7ae9bd9d92029e5b908f685153e76ba21473d93a134d3f758b4566bddb077367c1d859ec55

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1536	1520	rundll32.exe	27
PID 1520 wrote to memory of 1536	1520	rundll32.exe	27
PID 1520 wrote to memory of 1536	1520	rundll32.exe	27
PID 1520 wrote to memory of 1536	1520	rundll32.exe	27
PID 1520 wrote to memory of 1536	1520	rundll32.exe	27
PID 1520 wrote to memory of 1536	1520	rundll32.exe	27
PID 1520 wrote to memory of 1536	1520	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0963a44aad1ef28ffe117fc4d8d779dd2a1a5da2985473efe45b5d65038c270.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0963a44aad1ef28ffe117fc4d8d779dd2a1a5da2985473efe45b5d65038c270.dll,#1
  2⤵
  PID:1536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1536-55-0x0000000076371000-0x0000000076373000-memory.dmp

Filesize
8KB

Download