Analysis

  • max time kernel
    43s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    20-05-2022 05:39

General

  • Target

    02137e9426258e8d1186dc21ee344ffc5cdb3f068a6600ba1897fd9d27ccba43.dll

  • Size

    84KB

  • MD5

    1db5476c766555c9995b25d19f97b9bc

  • SHA1

    f509f352e4ee0f8d8ee2902721ae3a15799baba1

  • SHA256

    02137e9426258e8d1186dc21ee344ffc5cdb3f068a6600ba1897fd9d27ccba43

  • SHA512

    229badb4811990e692444bf93cf804cef087ea4333292d26cea4aeeb63e40d8d0780cf9b9663bb0c4dcdf2e9f15d24ccee80a4d236718475aeb0700adb6a2701

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\02137e9426258e8d1186dc21ee344ffc5cdb3f068a6600ba1897fd9d27ccba43.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1224
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\02137e9426258e8d1186dc21ee344ffc5cdb3f068a6600ba1897fd9d27ccba43.dll,#1
      2⤵
      • Drops file in System32 directory
      PID:1348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1348-55-0x0000000076531000-0x0000000076533000-memory.dmp

    Filesize

    8KB

  • memory/1348-59-0x0000000000200000-0x000000000021C000-memory.dmp

    Filesize

    112KB

  • memory/1348-61-0x0000000000200000-0x000000000021C000-memory.dmp

    Filesize

    112KB