2d54d23157e549d56edfa497620df75e4291413181f4883f91aecdfe9e38ae1a | Triage™

Analysis

max time kernel
4294180s
max time network
135s
platform
windows7_x64
resource
win7-20220311-en
submitted
23/03/2022, 07:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1664-56-0x0000000000170000-0x000000000017E000-memory.dll
Size 56KB
Sample220323-hw73fadfar
SHA256 2d54d23157e549d56edfa497620df75e4291413181f4883f91aecdfe9e38ae1a
MD5 957bf145eb17dd1e80ffabfe9578de02
SHA1 ab657c6b586d17dec42482660bfcf06b3e546ae1
SHA512 4b1a5c2288d4c8b2b6c401ee27a2fe94d080e246ea28b81fc4a78a8b94c386398f1dc04eea4894567cba514069baaae5ab208784b39b2842fe1323b15d19abf2
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1488	1664	rundll32.exe	27
PID 1664 wrote to memory of 1488	1664	rundll32.exe	27
PID 1664 wrote to memory of 1488	1664	rundll32.exe	27
PID 1664 wrote to memory of 1488	1664	rundll32.exe	27
PID 1664 wrote to memory of 1488	1664	rundll32.exe	27
PID 1664 wrote to memory of 1488	1664	rundll32.exe	27
PID 1664 wrote to memory of 1488	1664	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1664-56-0x0000000000170000-0x000000000017E000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1664-56-0x0000000000170000-0x000000000017E000-memory.dll,#1
  2⤵
  PID:1488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

Download