1b98e9ee92f90530743c0e79b9d9d1630c4e43b1241caf8bd13a27f6694f9777 | Triage

Analysis

max time kernel
25s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
07-06-2022 18:13

Sharing

Report Analysis Logs

General

Target

1b98e9ee92f90530743c0e79b9d9d1630c4e43b1241caf8bd13a27f6694f9777.dll
Size

202KB
MD5

4c8471847ccd4d26e841ce03ecd21348
SHA1

c38657fc0702eb24b7b3568c431387d2a3408dae
SHA256

1b98e9ee92f90530743c0e79b9d9d1630c4e43b1241caf8bd13a27f6694f9777
SHA512

a53ef0fe8dfa1b8f0d1e28d6c00ccbd362b597e5ebee1c3173d3fabc07dbb9a66fe9066abea86cfe5cca74e4fa7af1185b661ad2050fc13f5961fb790e15a4b0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1640 wrote to memory of 1668	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1668	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1668	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1668	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1668	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1668	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1668	1640	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b98e9ee92f90530743c0e79b9d9d1630c4e43b1241caf8bd13a27f6694f9777.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b98e9ee92f90530743c0e79b9d9d1630c4e43b1241caf8bd13a27f6694f9777.dll,#1
2⤵
PID:1668

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-54-0x0000000000000000-mapping.dmp

Download
memory/1668-55-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download