3a20d1c0976d357822513bab0f4abba2c914eb68a275cb19facc1245b78f77f8 | Triage

Analysis

max time kernel
35s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
12-07-2022 07:41

Sharing

Report Analysis Logs

General

Target

1652-57-0x00000000002C0000-0x00000000002E2000-memory.dll
Size

136KB
MD5

5449a7730d4a3454cf39db98eae4764f
SHA1

87c5253a1714f5ea1c76876ddbac3031eb97e826
SHA256

3a20d1c0976d357822513bab0f4abba2c914eb68a275cb19facc1245b78f77f8
SHA512

48388cdb33e5a1d2c44e0fb906ab81afd012a04089dcf4e69a35038139b4cbd9becee85e7335c484e29d1cbaf8ae1513b5c1b95eb9dbed92ad87d8a861586456

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1756 wrote to memory of 1720	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1720	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1720	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1720	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1720	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1720	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1720	1756	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1652-57-0x00000000002C0000-0x00000000002E2000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1652-57-0x00000000002C0000-0x00000000002E2000-memory.dll,#1
  2⤵
  PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-54-0x0000000000000000-mapping.dmp

Download
memory/1720-55-0x00000000753B1000-0x00000000753B3000-memory.dmp

Filesize
8KB

Download