00c1cc0ba66f03d31042842ba2852c7068735c88be975e14cf711f996226d2e3 | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
18-04-2022 15:31

Sharing

Report Analysis Logs

General

Target

00c1cc0ba66f03d31042842ba2852c7068735c88be975e14cf711f996226d2e3.dll
Size

1.6MB
MD5

e7cdb8bee224974ff5d78c85f53ca40c
SHA1

2ca1aa8088c8be1cce6000b51c4eac286e4d98f6
SHA256

00c1cc0ba66f03d31042842ba2852c7068735c88be975e14cf711f996226d2e3
SHA512

e8b50f0678c5e674195e38ce2508a2006b6d1e523d181970a522be684f499c5d2a30e7035cf496fefbf084cb480d2526f774441d8071168a80bf437a6f442c3e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1376 wrote to memory of 1492	1376	rundll32.exe	rundll32.exe
PID 1376 wrote to memory of 1492	1376	rundll32.exe	rundll32.exe
PID 1376 wrote to memory of 1492	1376	rundll32.exe	rundll32.exe
PID 1376 wrote to memory of 1492	1376	rundll32.exe	rundll32.exe
PID 1376 wrote to memory of 1492	1376	rundll32.exe	rundll32.exe
PID 1376 wrote to memory of 1492	1376	rundll32.exe	rundll32.exe
PID 1376 wrote to memory of 1492	1376	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00c1cc0ba66f03d31042842ba2852c7068735c88be975e14cf711f996226d2e3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1376

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00c1cc0ba66f03d31042842ba2852c7068735c88be975e14cf711f996226d2e3.dll,#1
2⤵
PID:1492

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1492-54-0x0000000000000000-mapping.dmp

Download
memory/1492-55-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download