624692be80c30558d1dc770175a97c7db8f75382b00122d6d77ed60cf24758dc | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
11-07-2022 10:37

Sharing

Report Analysis Logs

General

Target

1892-57-0x0000000000170000-0x0000000000192000-memory.dll
Size

136KB
MD5

81b7527b254ca750ae3270c7e144044d
SHA1

26a2604441e189f283e1a7f8979515ebf3f9476e
SHA256

624692be80c30558d1dc770175a97c7db8f75382b00122d6d77ed60cf24758dc
SHA512

d7a0316f51f74cd36b6ea6c7d5180cb8f5b1652e0ca4b3b11a7eb32b7fd68d7c8ced817e2736b8bf01a76bf17fb394b7c29f1bb8d8ec66d87aef09ffee027006

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1392 wrote to memory of 1632	1392	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 1632	1392	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 1632	1392	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 1632	1392	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 1632	1392	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 1632	1392	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 1632	1392	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1892-57-0x0000000000170000-0x0000000000192000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1892-57-0x0000000000170000-0x0000000000192000-memory.dll,#1
2⤵
PID:1632

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1632-54-0x0000000000000000-mapping.dmp

Download
memory/1632-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download