Analysis
-
max time kernel
8s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-06-2022 22:50
Static task
static1
Behavioral task
behavioral1
Sample
421867abea3ce5f660f9cf6ec1dc62a57d92edc122638d81e7a2d4ec389dd27a.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
421867abea3ce5f660f9cf6ec1dc62a57d92edc122638d81e7a2d4ec389dd27a.dll
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
421867abea3ce5f660f9cf6ec1dc62a57d92edc122638d81e7a2d4ec389dd27a.dll
-
Size
164KB
-
MD5
f9fc3de9c93b204279d32d682d6607b3
-
SHA1
c63832b46663954e5bd1791190302f97153e1102
-
SHA256
421867abea3ce5f660f9cf6ec1dc62a57d92edc122638d81e7a2d4ec389dd27a
-
SHA512
520e9ccfc7196cac3a27e8ee6c6f7daaa46717e4e88f08106dd693ac9f13b1bbb3e30ea08e245cd2ed8088ab672ea1708c5aa963535465b4b86a58dc2dd0ef3a
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 972 wrote to memory of 956 972 rundll32.exe rundll32.exe PID 972 wrote to memory of 956 972 rundll32.exe rundll32.exe PID 972 wrote to memory of 956 972 rundll32.exe rundll32.exe PID 972 wrote to memory of 956 972 rundll32.exe rundll32.exe PID 972 wrote to memory of 956 972 rundll32.exe rundll32.exe PID 972 wrote to memory of 956 972 rundll32.exe rundll32.exe PID 972 wrote to memory of 956 972 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\421867abea3ce5f660f9cf6ec1dc62a57d92edc122638d81e7a2d4ec389dd27a.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\421867abea3ce5f660f9cf6ec1dc62a57d92edc122638d81e7a2d4ec389dd27a.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/956-54-0x0000000000000000-mapping.dmp
-
memory/956-55-0x00000000753B1000-0x00000000753B3000-memory.dmpFilesize
8KB
-
memory/956-57-0x0000000002FAA000-0x0000000002FC1000-memory.dmpFilesize
92KB
-
memory/956-58-0x0000000002FD0000-0x00000000030FD000-memory.dmpFilesize
1.2MB
-
memory/956-59-0x0000000000370000-0x000000000038F000-memory.dmpFilesize
124KB
-
memory/956-60-0x0000000003450000-0x0000000003559000-memory.dmpFilesize
1.0MB
-
memory/956-62-0x0000000000180000-0x0000000000186000-memory.dmpFilesize
24KB
-
memory/956-61-0x0000000000140000-0x000000000014A000-memory.dmpFilesize
40KB