26a30811833fd93ecb266b4e2287e9b30cb99aff38e5109398462946fced4ab0 | Triage

Analysis

max time kernel
20s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22-08-2022 09:21

Sharing

Report Analysis Logs

General

Target

LOCALES/TWAIN_32.dll
Size

67KB
MD5

6bc0c27946a254e61a5124a38ad1ae62
SHA1

bad8ccfbed6110133e00d81f27bdb123f1854047
SHA256

0e7e161ea65bcfce69528a3147783e47102fb70f66adfbd7e9e0738799bf70a4
SHA512

1354b01d87707ea45e4de087fb03f9bb8d06f6dfc40f6d05bda7276654b9a1521de1df7570d02df4766e1730de88c002b2e70fa864fb5aec0f7789c1214f4ebf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1940 wrote to memory of 1368	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 1368	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 1368	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 1368	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 1368	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 1368	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 1368	1940	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LOCALES\TWAIN_32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LOCALES\TWAIN_32.dll,#1
2⤵
PID:1368

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-54-0x0000000000000000-mapping.dmp

Download
memory/1368-55-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download