015023eca9b453647fb666de2d78ffa308cf284717f134e54dd0528229cef53b | Triage

Analysis

max time kernel
4294093s
max time network
28s
platform
windows7_x64
resource
win7-20220311-en
submitted
15-03-2022 10:26

Sharing

Report Analysis Logs

General

Target

015023eca9b453647fb666de2d78ffa308cf284717f134e54dd0528229cef53b.dll
Size

208KB
MD5

b9633de88b7e0f25893cb43a878aa2b6
SHA1

9de65ed6b6de7c28077189b1fb8c2cab06f83808
SHA256

015023eca9b453647fb666de2d78ffa308cf284717f134e54dd0528229cef53b
SHA512

96df62fe3fc4db59cc1de67c36567de39bb5f5c55318bd32b35b49b9042eac37aebd03d1889ae40021b9fa673a6ddf4e59b4387202ce213c6880df41c3d4d498

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1464 wrote to memory of 1712	1464	rundll32.exe	rundll32.exe
PID 1464 wrote to memory of 1712	1464	rundll32.exe	rundll32.exe
PID 1464 wrote to memory of 1712	1464	rundll32.exe	rundll32.exe
PID 1464 wrote to memory of 1712	1464	rundll32.exe	rundll32.exe
PID 1464 wrote to memory of 1712	1464	rundll32.exe	rundll32.exe
PID 1464 wrote to memory of 1712	1464	rundll32.exe	rundll32.exe
PID 1464 wrote to memory of 1712	1464	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\015023eca9b453647fb666de2d78ffa308cf284717f134e54dd0528229cef53b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\015023eca9b453647fb666de2d78ffa308cf284717f134e54dd0528229cef53b.dll,#1
2⤵
PID:1712

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1712-54-0x0000000075B01000-0x0000000075B03000-memory.dmp

Filesize
8KB

Download