83236cf44a4f97d773664ddebd6faaeb6c0fdf809d43632b49e6345217a4b85f | Triage

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220414-en
submitted
27-04-2022 18:10

Sharing

Report Analysis Logs

General

Target

83236cf44a4f97d773664ddebd6faaeb6c0fdf809d43632b49e6345217a4b85f.dll
Size

347KB
MD5

1437828abd9a9bb73983adfe5c1d42de
SHA1

4b997c7f4fa682dfcf93fdc85a51622d6c09929f
SHA256

83236cf44a4f97d773664ddebd6faaeb6c0fdf809d43632b49e6345217a4b85f
SHA512

e8805fe3359c493419ac5ce606f97eaf3bdd22a9205ad49d6e133a785fcf20954af932a6e31a522f056f02f46bda48b1263a6f4ec961934140791149056d76a5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 560 wrote to memory of 952	560	rundll32.exe	rundll32.exe
PID 560 wrote to memory of 952	560	rundll32.exe	rundll32.exe
PID 560 wrote to memory of 952	560	rundll32.exe	rundll32.exe
PID 560 wrote to memory of 952	560	rundll32.exe	rundll32.exe
PID 560 wrote to memory of 952	560	rundll32.exe	rundll32.exe
PID 560 wrote to memory of 952	560	rundll32.exe	rundll32.exe
PID 560 wrote to memory of 952	560	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\83236cf44a4f97d773664ddebd6faaeb6c0fdf809d43632b49e6345217a4b85f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:560

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\83236cf44a4f97d773664ddebd6faaeb6c0fdf809d43632b49e6345217a4b85f.dll,#1
2⤵
PID:952

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/952-54-0x0000000000000000-mapping.dmp

Download
memory/952-55-0x0000000075271000-0x0000000075273000-memory.dmp

Filesize
8KB

Download
memory/952-56-0x0000000000250000-0x0000000000308000-memory.dmp

Filesize
736KB

Download