a67b23e806d1e74ad0043fd323500d1e30ebbe2ffed18de09b5059a9f4e5990f | Triage

Analysis

max time kernel
57s
max time network
44s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
31-07-2022 08:48

Sharing

Report Analysis Logs

General

Target

a67b23e806d1e74ad0043fd323500d1e30ebbe2ffed18de09b5059a9f4e5990f.dll
Size

164KB
MD5

e5e1481d1be4dbfd85186dfb84df9aa3
SHA1

bce53c099e215c2f9b8d3c4bebeeff1f3b03fe54
SHA256

a67b23e806d1e74ad0043fd323500d1e30ebbe2ffed18de09b5059a9f4e5990f
SHA512

cfbd97e819aadcadd9e1e5602b27034873c160fefb0483fdb23f420b6e87ed49591a401a0adff61a8335bca77bea15d8f7e1288072ff8fed6f6cd907e8327f5c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1964 wrote to memory of 1996	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 1996	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 1996	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 1996	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 1996	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 1996	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 1996	1964	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a67b23e806d1e74ad0043fd323500d1e30ebbe2ffed18de09b5059a9f4e5990f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a67b23e806d1e74ad0043fd323500d1e30ebbe2ffed18de09b5059a9f4e5990f.dll,#1
2⤵
PID:1996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-54-0x0000000000000000-mapping.dmp

Download
memory/1996-55-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download