570ac8065502d2f0620cb93ff54dc521cbe2685d4452ab01aeb1da5ae9dd31f3 | Triage

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220414-en
submitted
23-06-2022 13:54

Sharing

Report Analysis Logs

General

Target

900-57-0x0000000000270000-0x0000000000292000-memory.dll
Size

136KB
MD5

8b8e730974f5990092be72be7f69702c
SHA1

7b50a95d400a95d8f7dcb95cdcc766d8dc50ec8a
SHA256

570ac8065502d2f0620cb93ff54dc521cbe2685d4452ab01aeb1da5ae9dd31f3
SHA512

c13842c1015b8b4df60ac47487636cc5b2f7a02406986c87f6edc799818f093fcf2120f05dfe41c7a0e7c7c0e1db04dbba9e5b623c701c135140e695a0025680

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1100 wrote to memory of 1724	1100	rundll32.exe	rundll32.exe
PID 1100 wrote to memory of 1724	1100	rundll32.exe	rundll32.exe
PID 1100 wrote to memory of 1724	1100	rundll32.exe	rundll32.exe
PID 1100 wrote to memory of 1724	1100	rundll32.exe	rundll32.exe
PID 1100 wrote to memory of 1724	1100	rundll32.exe	rundll32.exe
PID 1100 wrote to memory of 1724	1100	rundll32.exe	rundll32.exe
PID 1100 wrote to memory of 1724	1100	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\900-57-0x0000000000270000-0x0000000000292000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\900-57-0x0000000000270000-0x0000000000292000-memory.dll,#1
2⤵
PID:1724

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-54-0x0000000000000000-mapping.dmp

Download
memory/1724-55-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download