737ed35ffa410fef425d4a62832f39522f58bbaec02ca35c7909192ca66d3e7f | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
04-07-2022 10:19

Sharing

Report Analysis Logs

General

Target

112-57-0x0000000000100000-0x0000000000122000-memory.dll
Size

136KB
MD5

57d035b0ee2451ea1e7af70b736ef26a
SHA1

6c2b3d4e7b3c6359c38b4f6b39b5c0d1145dad4a
SHA256

737ed35ffa410fef425d4a62832f39522f58bbaec02ca35c7909192ca66d3e7f
SHA512

7c93979c80a78a59151de19b5f47cbfd2a3622747ba94e75636f6ffbbd579a1456a6f4d8b6c3fb20e32adbb5e00ab9feb826a7b4a4e28b51453ee98f5bcbda72

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1684 wrote to memory of 1912	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 1912	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 1912	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 1912	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 1912	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 1912	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 1912	1684	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\112-57-0x0000000000100000-0x0000000000122000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\112-57-0x0000000000100000-0x0000000000122000-memory.dll,#1
2⤵
PID:1912

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1912-54-0x0000000000000000-mapping.dmp

Download
memory/1912-55-0x0000000074F91000-0x0000000074F93000-memory.dmp

Filesize
8KB

Download