7d1af94061f9bbea1b811992c5c44ca26449586e6587b077e8e05b8888a9a597 | Triage

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220414-en
submitted
25-06-2022 06:42

Sharing

Report Analysis Logs

General

Target

7d1af94061f9bbea1b811992c5c44ca26449586e6587b077e8e05b8888a9a597.dll
Size

158KB
MD5

d9e4ac2ba2f449fefb08a056f4a86577
SHA1

c9d64052ad833489448964c491b95f4a8a045354
SHA256

7d1af94061f9bbea1b811992c5c44ca26449586e6587b077e8e05b8888a9a597
SHA512

160b6709e93d644b1e8684584aec3c083cce90a7ab0fb0932eaf1e5d9afbec195570f2a7feaba333299715c0d66871354ccceed1263b39f737c6026c33d30bb8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1096 wrote to memory of 1912	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1912	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1912	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1912	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1912	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1912	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1912	1096	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d1af94061f9bbea1b811992c5c44ca26449586e6587b077e8e05b8888a9a597.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d1af94061f9bbea1b811992c5c44ca26449586e6587b077e8e05b8888a9a597.dll,#1
2⤵
PID:1912

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1912-54-0x0000000000000000-mapping.dmp

Download
memory/1912-55-0x00000000768D1000-0x00000000768D3000-memory.dmp

Filesize
8KB

Download