6a133b43bb3fdc4c006befaee2fb93678595260ab3576e5f8d8bae2d4a680d04 | Triage

Analysis

max time kernel
15s
max time network
117s
platform
windows7_x64
resource
win7-20220414-en
submitted
30-06-2022 19:52

Sharing

Report Analysis Logs

General

Target

6a133b43bb3fdc4c006befaee2fb93678595260ab3576e5f8d8bae2d4a680d04.dll
Size

426KB
MD5

9645557361331761cfd2dcc10240768f
SHA1

d0cac766527a167da252605c6e0502967a1123c6
SHA256

6a133b43bb3fdc4c006befaee2fb93678595260ab3576e5f8d8bae2d4a680d04
SHA512

ba69edefdd147160e0ef56de39f2ad2a1448aab10cfdb12db83e9bd086051d4aac2c255cb0bb46eea7e13ce8c910f6483cfa5f7f151717ea99c51614e487f0d2

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1664 rundll32.exe
1664 rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1532 wrote to memory of 1664	1532	rundll32.exe	rundll32.exe
PID 1532 wrote to memory of 1664	1532	rundll32.exe	rundll32.exe
PID 1532 wrote to memory of 1664	1532	rundll32.exe	rundll32.exe
PID 1532 wrote to memory of 1664	1532	rundll32.exe	rundll32.exe
PID 1532 wrote to memory of 1664	1532	rundll32.exe	rundll32.exe
PID 1532 wrote to memory of 1664	1532	rundll32.exe	rundll32.exe
PID 1532 wrote to memory of 1664	1532	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a133b43bb3fdc4c006befaee2fb93678595260ab3576e5f8d8bae2d4a680d04.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a133b43bb3fdc4c006befaee2fb93678595260ab3576e5f8d8bae2d4a680d04.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1664-54-0x0000000000000000-mapping.dmp

Download
memory/1664-55-0x0000000075581000-0x0000000075583000-memory.dmp

Filesize
8KB

Download
memory/1664-56-0x00000000001E0000-0x0000000000200000-memory.dmp

Filesize
128KB

Download