67a9e8599ab71865a97e75dae9be438c24d015a93e6a12fb5b450ec558528290 | Triage

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220414-en
submitted
30-06-2022 09:25

Sharing

Report Analysis Logs

General

Target

pkmcntrs.dll
Size

1.5MB
MD5

d902d9b6580de0f0264e23b4000b5070
SHA1

9ca85ea9142c2135fc912bbbcb6d1db85c40f3a4
SHA256

67a9e8599ab71865a97e75dae9be438c24d015a93e6a12fb5b450ec558528290
SHA512

c971dacbfd9b9bb9e6a6f6d666576c2ff5f8854941b5b9c5057d907032cdba902fab7723bcb2b81108b2657edc964ef90d78f2a43252714350129e72b3c4416b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1512 wrote to memory of 1660	1512	rundll32.exe	rundll32.exe
PID 1512 wrote to memory of 1660	1512	rundll32.exe	rundll32.exe
PID 1512 wrote to memory of 1660	1512	rundll32.exe	rundll32.exe
PID 1512 wrote to memory of 1660	1512	rundll32.exe	rundll32.exe
PID 1512 wrote to memory of 1660	1512	rundll32.exe	rundll32.exe
PID 1512 wrote to memory of 1660	1512	rundll32.exe	rundll32.exe
PID 1512 wrote to memory of 1660	1512	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\pkmcntrs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\pkmcntrs.dll,#1
  2⤵
  PID:1660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1660-54-0x0000000000000000-mapping.dmp

Download
memory/1660-55-0x0000000076421000-0x0000000076423000-memory.dmp

Filesize
8KB

Download