bed8c0161b5e7cc1f536eb4b3ebbdc9d3cc0ede5b3ed68b33a1fecc1c8d37fc7 | Triage

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
25-06-2022 05:23

Sharing

Report Analysis Logs

General

Target

bed8c0161b5e7cc1f536eb4b3ebbdc9d3cc0ede5b3ed68b33a1fecc1c8d37fc7.dll
Size

216KB
MD5

7be79bcee33e5409fdd006241886de6e
SHA1

9ff95fbb889af1594b234a126e0b7f432241f4f2
SHA256

bed8c0161b5e7cc1f536eb4b3ebbdc9d3cc0ede5b3ed68b33a1fecc1c8d37fc7
SHA512

f855a29768599469835b1a9d27d500ea40869f3683b37e22f79788e3ef15b19d3b348f2938cea64d6eb6145abe4e45c03d7a9a37121fdc101ac349b2d0aa0f50

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 908 wrote to memory of 1328	908	rundll32.exe	rundll32.exe
PID 908 wrote to memory of 1328	908	rundll32.exe	rundll32.exe
PID 908 wrote to memory of 1328	908	rundll32.exe	rundll32.exe
PID 908 wrote to memory of 1328	908	rundll32.exe	rundll32.exe
PID 908 wrote to memory of 1328	908	rundll32.exe	rundll32.exe
PID 908 wrote to memory of 1328	908	rundll32.exe	rundll32.exe
PID 908 wrote to memory of 1328	908	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bed8c0161b5e7cc1f536eb4b3ebbdc9d3cc0ede5b3ed68b33a1fecc1c8d37fc7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:908

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bed8c0161b5e7cc1f536eb4b3ebbdc9d3cc0ede5b3ed68b33a1fecc1c8d37fc7.dll,#1
2⤵
PID:1328

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1328-54-0x0000000000000000-mapping.dmp

Download
memory/1328-55-0x0000000074F91000-0x0000000074F93000-memory.dmp

Filesize
8KB

Download