17502d6018ea815fa7e922c8349377b569cfd4a5da7cfb6ed09b7b6463ed0e28 | Triage

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220414-en
submitted
08-06-2022 21:23

Sharing

Report Analysis Logs

General

Target

17502d6018ea815fa7e922c8349377b569cfd4a5da7cfb6ed09b7b6463ed0e28.dll
Size

164KB
MD5

5804a0d6ea9a6ec4b9e93c406b36800b
SHA1

f63ccf1f6b65985a271c67fbc81a0123ba798276
SHA256

17502d6018ea815fa7e922c8349377b569cfd4a5da7cfb6ed09b7b6463ed0e28
SHA512

90c4e62b7b2414d3010dc06a8dd71dd147c2328e5a7324aabb4aef6cad03ffabcf005a50eb8270672e3be55e1b680faf222bfd0d9fcb0cb785eaec5e6d9de520

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1980 wrote to memory of 940	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 940	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 940	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 940	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 940	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 940	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 940	1980	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17502d6018ea815fa7e922c8349377b569cfd4a5da7cfb6ed09b7b6463ed0e28.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17502d6018ea815fa7e922c8349377b569cfd4a5da7cfb6ed09b7b6463ed0e28.dll,#1
2⤵
PID:940

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/940-54-0x0000000000000000-mapping.dmp

Download
memory/940-55-0x0000000076C01000-0x0000000076C03000-memory.dmp

Filesize
8KB

Download