c58d97e033d7b568ce4261959e5e04a5b1f8849ccf4f717bcac79ca728d07ace | Triage

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220414-en
submitted
18-04-2022 15:30

Sharing

Report Analysis Logs

General

Target

c58d97e033d7b568ce4261959e5e04a5b1f8849ccf4f717bcac79ca728d07ace.dll
Size

445KB
MD5

62b048529ddc7e871a9807068ee5cacd
SHA1

1aef66bb26dad4ba2fd182f01efd13e44e4bfe31
SHA256

c58d97e033d7b568ce4261959e5e04a5b1f8849ccf4f717bcac79ca728d07ace
SHA512

74b64e2d78bdec8c82835c5ac7501c3a18a9ad1e25da959bfa08df77fec96ad0a6e61277c2ec4ffadf329961614d5f9f3d012351211782a9ff146fcecc9b1f04

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1992 wrote to memory of 1920	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1920	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1920	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1920	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1920	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1920	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1920	1992	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c58d97e033d7b568ce4261959e5e04a5b1f8849ccf4f717bcac79ca728d07ace.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c58d97e033d7b568ce4261959e5e04a5b1f8849ccf4f717bcac79ca728d07ace.dll,#1
  2⤵
  PID:1920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1920-54-0x0000000000000000-mapping.dmp

Download
memory/1920-55-0x0000000075DB1000-0x0000000075DB3000-memory.dmp

Filesize
8KB

Download