5e27f206cca8c47995cbb6b9a3ad649d76941c48eda11ece878090ca01a54003 | Triage

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
27-06-2022 11:28

Sharing

Report Analysis Logs

General

Target

1944-57-0x0000000000200000-0x0000000000222000-memory.dll
Size

136KB
MD5

39b7b2617a589066b75045b2b5be852b
SHA1

0e5c116bba9fef10a5567e87369368e52a4b0631
SHA256

5e27f206cca8c47995cbb6b9a3ad649d76941c48eda11ece878090ca01a54003
SHA512

db939fae1e4104cc8e431b598e0ceedf78a95ac075d5e110a9e8e597cabe239e964fbd805c058df6dca0a605f72d5388e6d37be84b0249d8873778692f600cf1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1012 wrote to memory of 760	1012	rundll32.exe	rundll32.exe
PID 1012 wrote to memory of 760	1012	rundll32.exe	rundll32.exe
PID 1012 wrote to memory of 760	1012	rundll32.exe	rundll32.exe
PID 1012 wrote to memory of 760	1012	rundll32.exe	rundll32.exe
PID 1012 wrote to memory of 760	1012	rundll32.exe	rundll32.exe
PID 1012 wrote to memory of 760	1012	rundll32.exe	rundll32.exe
PID 1012 wrote to memory of 760	1012	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-57-0x0000000000200000-0x0000000000222000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1012

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-57-0x0000000000200000-0x0000000000222000-memory.dll,#1
2⤵
PID:760

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/760-54-0x0000000000000000-mapping.dmp

Download
memory/760-55-0x0000000076851000-0x0000000076853000-memory.dmp

Filesize
8KB

Download