0d349b6bf414eabec5f852193876fe67bcaa109089e631a2b6d72650f3b5d95f | Triage

Analysis

max time kernel
27s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
12-07-2022 08:17

Sharing

Report Analysis Logs

General

Target

896-57-0x0000000000AD0000-0x0000000000AF2000-memory.dll
Size

136KB
MD5

e455c6f59629f02d41ecbd2c0bc6b918
SHA1

351d693df955de8cab91472e11a09963483233ae
SHA256

0d349b6bf414eabec5f852193876fe67bcaa109089e631a2b6d72650f3b5d95f
SHA512

1917e303fb6539005b050381c4f544e752d61c7ec3ac8114e9d632dc864748aa997fe12115b244fb4ad426b007da0caa851e7a98a02fa8b6b56cec407967b9ac

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1912 wrote to memory of 1648	1912	rundll32.exe	rundll32.exe
PID 1912 wrote to memory of 1648	1912	rundll32.exe	rundll32.exe
PID 1912 wrote to memory of 1648	1912	rundll32.exe	rundll32.exe
PID 1912 wrote to memory of 1648	1912	rundll32.exe	rundll32.exe
PID 1912 wrote to memory of 1648	1912	rundll32.exe	rundll32.exe
PID 1912 wrote to memory of 1648	1912	rundll32.exe	rundll32.exe
PID 1912 wrote to memory of 1648	1912	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\896-57-0x0000000000AD0000-0x0000000000AF2000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\896-57-0x0000000000AD0000-0x0000000000AF2000-memory.dll,#1
2⤵
PID:1648

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-54-0x0000000000000000-mapping.dmp

Download
memory/1648-55-0x0000000075F61000-0x0000000075F63000-memory.dmp

Filesize
8KB

Download