aacf8cfa597adf7eb6f1b526a4272c5e2a6d95635160b21a14ef539d2d8cfc37 | Triage

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220414-en
submitted
12-07-2022 07:11

Sharing

Report Analysis Logs

General

Target

2044-57-0x0000000000440000-0x0000000000462000-memory.dll
Size

136KB
MD5

65b4285bbf25f0b4c4f185952f60d8e6
SHA1

d8bc72738c25c39cdb970a44990483f3ec8ef67b
SHA256

aacf8cfa597adf7eb6f1b526a4272c5e2a6d95635160b21a14ef539d2d8cfc37
SHA512

aee8f719008a3c09df319703ad5aaaf5d48fde51b3da5e5bc1179928ffb12f71085c6b89d11dee4c23e6e258c1879c7322663b2fbce61c3bef9d00882e6fc476

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 892 wrote to memory of 884	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 884	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 884	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 884	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 884	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 884	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 884	892	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000000440000-0x0000000000462000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:892

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000000440000-0x0000000000462000-memory.dll,#1
2⤵
PID:884

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/884-54-0x0000000000000000-mapping.dmp

Download
memory/884-55-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download