d16191047b6c5690d518ee74df53d731747cac682283b76a6c4e941034d60ab8 | Triage™

Analysis

max time kernel
4294181s
max time network
124s
platform
windows7_x64
resource
win7-20220311-en
submitted
17/03/2022, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1796-57-0x0000000000790000-0x000000000079E000-memory.dll
Size 56KB
Sample220317-llzvvsbbck
SHA256 d16191047b6c5690d518ee74df53d731747cac682283b76a6c4e941034d60ab8
MD5 1bc0a71858c5759193c3b249c4f2794b
SHA1 f3d9590788920c4f413b827548c986f55ba32405
SHA512 0bbe6aa6a9c9065d4b412463f9ab0ec37cea785f389956c4845561d0fef54146a384f34991e8509a26834490d8dd75cea9f02aca49d69d9f4cde4305fe2cd95a
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 580	1336	rundll32.exe	27
PID 1336 wrote to memory of 580	1336	rundll32.exe	27
PID 1336 wrote to memory of 580	1336	rundll32.exe	27
PID 1336 wrote to memory of 580	1336	rundll32.exe	27
PID 1336 wrote to memory of 580	1336	rundll32.exe	27
PID 1336 wrote to memory of 580	1336	rundll32.exe	27
PID 1336 wrote to memory of 580	1336	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x0000000000790000-0x000000000079E000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x0000000000790000-0x000000000079E000-memory.dll,#1
  2⤵
  PID:580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-54-0x0000000075561000-0x0000000075563000-memory.dmp

Download