39fca7fbfd1b8a31cd899a6b649e85ca8bb9fe770d2ecbe75cad29e24eceba1e | Triage

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220414-en
submitted
25-06-2022 07:10

Sharing

Report Analysis Logs

General

Target

39fca7fbfd1b8a31cd899a6b649e85ca8bb9fe770d2ecbe75cad29e24eceba1e.dll
Size

164KB
MD5

c26a7ea5728b33a046b0c77a59a6ccc9
SHA1

98c717ca6a721ba73ec9afdd6e827e8bcd2873a0
SHA256

39fca7fbfd1b8a31cd899a6b649e85ca8bb9fe770d2ecbe75cad29e24eceba1e
SHA512

9b75945175914edba61d0ea8a91bdb692ef31e15786ea73313f8e8528e8d06ade99fce8cc5ee0c9952da661d5e37f987475565b7c9ae9e37013a72ab4e00cb93

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1980 wrote to memory of 1824	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1824	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1824	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1824	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1824	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1824	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1824	1980	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39fca7fbfd1b8a31cd899a6b649e85ca8bb9fe770d2ecbe75cad29e24eceba1e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39fca7fbfd1b8a31cd899a6b649e85ca8bb9fe770d2ecbe75cad29e24eceba1e.dll,#1
2⤵
PID:1824

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1824-54-0x0000000000000000-mapping.dmp

Download
memory/1824-55-0x00000000768D1000-0x00000000768D3000-memory.dmp

Filesize
8KB

Download