c489a2b966c615504a618c46ab8dbbe94d5f11cec2219113c2d0b62e4bb497d2 | Triage

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220414-en
submitted
25-06-2022 07:23

Sharing

Report Analysis Logs

General

Target

c489a2b966c615504a618c46ab8dbbe94d5f11cec2219113c2d0b62e4bb497d2.dll
Size

305KB
MD5

a3c8febccc2edd615ff98e78b8ebf6c2
SHA1

071f15d61322c0480bb71690ed114f3736f7844c
SHA256

c489a2b966c615504a618c46ab8dbbe94d5f11cec2219113c2d0b62e4bb497d2
SHA512

6c15e95112868969184d511f5cc35bddd868e8e2a4c61b4c12bff45383e62a0a90fe1fde4bd56fa0dca1523ebf90c05e8a5e08966d3b6f85517156fd5d38d28b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 1548	560	rundll32.exe	27
PID 560 wrote to memory of 1548	560	rundll32.exe	27
PID 560 wrote to memory of 1548	560	rundll32.exe	27
PID 560 wrote to memory of 1548	560	rundll32.exe	27
PID 560 wrote to memory of 1548	560	rundll32.exe	27
PID 560 wrote to memory of 1548	560	rundll32.exe	27
PID 560 wrote to memory of 1548	560	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c489a2b966c615504a618c46ab8dbbe94d5f11cec2219113c2d0b62e4bb497d2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c489a2b966c615504a618c46ab8dbbe94d5f11cec2219113c2d0b62e4bb497d2.dll,#1
  2⤵
  PID:1548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1548-55-0x0000000075701000-0x0000000075703000-memory.dmp

Filesize
8KB

Download