02a593571d2221f5eccdba5cbfaccba9f2a821fdc2b133895c0916b41f8cf575 | Triage

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220414-en
submitted
27-04-2022 18:13

Sharing

Report Analysis Logs

General

Target

02a593571d2221f5eccdba5cbfaccba9f2a821fdc2b133895c0916b41f8cf575.dll
Size

347KB
MD5

a2d191168117d47b6b198ca0cb41e3e2
SHA1

81f69c70490f4aee50ac1e5121686a2632e568bd
SHA256

02a593571d2221f5eccdba5cbfaccba9f2a821fdc2b133895c0916b41f8cf575
SHA512

af02093a3d4f40eddfa8c4060443f4b7f24c781795c41ae459ecb6f488ff39a9fa841924bc5118ceeda6f3d882fd27474c3bd3230d3980eb8885fab0da8a3ec2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 824 wrote to memory of 1496	824	rundll32.exe	rundll32.exe
PID 824 wrote to memory of 1496	824	rundll32.exe	rundll32.exe
PID 824 wrote to memory of 1496	824	rundll32.exe	rundll32.exe
PID 824 wrote to memory of 1496	824	rundll32.exe	rundll32.exe
PID 824 wrote to memory of 1496	824	rundll32.exe	rundll32.exe
PID 824 wrote to memory of 1496	824	rundll32.exe	rundll32.exe
PID 824 wrote to memory of 1496	824	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\02a593571d2221f5eccdba5cbfaccba9f2a821fdc2b133895c0916b41f8cf575.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:824

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\02a593571d2221f5eccdba5cbfaccba9f2a821fdc2b133895c0916b41f8cf575.dll,#1
2⤵
PID:1496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1496-54-0x0000000000000000-mapping.dmp

Download
memory/1496-55-0x0000000075741000-0x0000000075743000-memory.dmp

Filesize
8KB

Download
memory/1496-56-0x00000000006F0000-0x00000000007A8000-memory.dmp

Filesize
736KB

Download