0a222596fb44938adfb2b8389c06f67dc29f6bdd9267b4b0e0bb1450e22fd53a | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
11-07-2022 17:47

Sharing

Report Analysis Logs

General

Target

896-56-0x0000000000290000-0x00000000002B2000-memory.dll
Size

136KB
MD5

9227b44f5e404cddbc609cb602bb6702
SHA1

bb80a6ab86ececd348520df7dd05c2420f628255
SHA256

0a222596fb44938adfb2b8389c06f67dc29f6bdd9267b4b0e0bb1450e22fd53a
SHA512

97674cbf688ffed328587000cbcb26b770f8cfedea3fe0c45df8109661dfa12ab06e8dff074636119e6992862dc3dbabaa43fb223ecac7ccec54236fce05985e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1652 wrote to memory of 1572	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1572	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1572	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1572	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1572	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1572	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1572	1652	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\896-56-0x0000000000290000-0x00000000002B2000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\896-56-0x0000000000290000-0x00000000002B2000-memory.dll,#1
2⤵
PID:1572

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1572-54-0x0000000000000000-mapping.dmp

Download
memory/1572-55-0x0000000075581000-0x0000000075583000-memory.dmp

Filesize
8KB

Download