605b08c4a47ffc5e8021604b4b8ead2be1fe50c1fa3145502f2320b5456f9cbf | Triage

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
11-07-2022 12:52

Sharing

Report Analysis Logs

General

Target

1816-57-0x00000000001D0000-0x00000000001F2000-memory.dll
Size

136KB
MD5

5b4aa7b10a11d6ab858b0b07e700131c
SHA1

ecf87dd6ff081509c7f3f5f1b23826bd61b25387
SHA256

605b08c4a47ffc5e8021604b4b8ead2be1fe50c1fa3145502f2320b5456f9cbf
SHA512

a1dcf7191c2d91c4a35acbe30ec8b38f8dd15114c0291d269d1f821f918f94b087f3bd90caa4a62c057e40cafc17c6debf8c99215cf4a2a3043aad067856b941

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1460 wrote to memory of 1064	1460	rundll32.exe	rundll32.exe
PID 1460 wrote to memory of 1064	1460	rundll32.exe	rundll32.exe
PID 1460 wrote to memory of 1064	1460	rundll32.exe	rundll32.exe
PID 1460 wrote to memory of 1064	1460	rundll32.exe	rundll32.exe
PID 1460 wrote to memory of 1064	1460	rundll32.exe	rundll32.exe
PID 1460 wrote to memory of 1064	1460	rundll32.exe	rundll32.exe
PID 1460 wrote to memory of 1064	1460	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1816-57-0x00000000001D0000-0x00000000001F2000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1816-57-0x00000000001D0000-0x00000000001F2000-memory.dll,#1
2⤵
PID:1064

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1064-54-0x0000000000000000-mapping.dmp

Download
memory/1064-55-0x00000000769D1000-0x00000000769D3000-memory.dmp

Filesize
8KB

Download