a789b89f0da4794a2299e49e6dc1c1bf9d6790bcc9e1bb9cc87e77116715e7af | Triage™

Resubmissions

04/08/2022, 15:52

220804-ta325shfap

24/05/2022, 17:22

220524-vxll2sbac210

Analysis

max time kernel
9s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
24/05/2022, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lib1.dll
Size 394KB
Sample220524-vxll2sbac2
SHA256 e79f95d218aacbdcb35c4a843d999f8a642111fae72f7f20534c36a339580db0
MD5 00d8bba1b87c9ad7a19e843f17bd0398
SHA1 a1c70baaf38dc9641b7feb211d8cbedeae1f1908
SHA512 8513c2f0ccf88977cb1ea8ad2f97d5d73eb25ecc3fe061f56aa80a76fe4dd29e47601960007bc5fdc40a26225d260846443246e0a489f9fccb40d34291389ff7
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1648	2020	rundll32.exe	16
PID 2020 wrote to memory of 1648	2020	rundll32.exe	16
PID 2020 wrote to memory of 1648	2020	rundll32.exe	16
PID 2020 wrote to memory of 1648	2020	rundll32.exe	16
PID 2020 wrote to memory of 1648	2020	rundll32.exe	16
PID 2020 wrote to memory of 1648	2020	rundll32.exe	16
PID 2020 wrote to memory of 1648	2020	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib1.dll,#1
1⤵
PID:1648

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Download