75f51c1238d8064298f231d387892c58bca859ec7087fd10e6e1a0a493f6f30a | Triage

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
16-09-2022 17:13

Sharing

Report Analysis Logs

General

Target

look/youIn.dll
Size

3KB
MD5

b83bebd6d4214aaddb333d720a56db15
SHA1

fe7562e8deb7a4ae47e5183cab2ee6e053a05bc2
SHA256

d0a3cdc531a3c40b67d9ff093dc96a19db3f5fe52d718468988b67f999b53411
SHA512

f19788a9417bfb3fed7326e7ff29b690217f354d02912fdf8460f7f0e9a3fe17aeab540f4b014d0996cff22fa9c2aaec73725a50c999f6cefed28d09d6dd2286

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1552 wrote to memory of 1612	1552	rundll32.exe	rundll32.exe
PID 1552 wrote to memory of 1612	1552	rundll32.exe	rundll32.exe
PID 1552 wrote to memory of 1612	1552	rundll32.exe	rundll32.exe
PID 1552 wrote to memory of 1612	1552	rundll32.exe	rundll32.exe
PID 1552 wrote to memory of 1612	1552	rundll32.exe	rundll32.exe
PID 1552 wrote to memory of 1612	1552	rundll32.exe	rundll32.exe
PID 1552 wrote to memory of 1612	1552	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\look\youIn.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\look\youIn.dll,#1
2⤵
PID:1612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-54-0x0000000000000000-mapping.dmp

Download
memory/1612-55-0x0000000075681000-0x0000000075683000-memory.dmp

Filesize
8KB

Download