4d57595dd0174ff752b3286c012f3fb8edeec2e03877971dda66ec40c94d9204 | Triage

Analysis

max time kernel
36s
max time network
43s
platform
windows7_x64
resource
win7-20220414-en
submitted
12-07-2022 03:18

Sharing

Report Analysis Logs

General

Target

4d57595dd0174ff752b3286c012f3fb8edeec2e03877971dda66ec40c94d9204.dll
Size

62KB
MD5

d797d3c51f57fff2bf0a6f8408ec3646
SHA1

89f4e61ce2317d0458e8ebd5e9df8abee47ab491
SHA256

4d57595dd0174ff752b3286c012f3fb8edeec2e03877971dda66ec40c94d9204
SHA512

2a296ba79e98398fd7ed7649f70bf366ae221356dc6ec78291350bb89fa78675165db660c81c2dc0f14530977ea45a005c80129badb09f56a18d2e9416ee7b8c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2040 wrote to memory of 112	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 112	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 112	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 112	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 112	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 112	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 112	2040	rundll32.exe	rundll32.exe
PID 112 wrote to memory of 868	112	rundll32.exe	rundll32.exe
PID 112 wrote to memory of 868	112	rundll32.exe	rundll32.exe
PID 112 wrote to memory of 868	112	rundll32.exe	rundll32.exe
PID 112 wrote to memory of 868	112	rundll32.exe	rundll32.exe
PID 112 wrote to memory of 868	112	rundll32.exe	rundll32.exe
PID 112 wrote to memory of 868	112	rundll32.exe	rundll32.exe
PID 112 wrote to memory of 868	112	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d57595dd0174ff752b3286c012f3fb8edeec2e03877971dda66ec40c94d9204.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d57595dd0174ff752b3286c012f3fb8edeec2e03877971dda66ec40c94d9204.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:112

C:\Windows\SysWOW64\rundll32.exe
--9dfb4f4a
3⤵
PID:868

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/112-54-0x0000000000000000-mapping.dmp

Download
memory/112-55-0x0000000075191000-0x0000000075193000-memory.dmp

Filesize
8KB

Download
memory/868-56-0x0000000000000000-mapping.dmp

Download