39c01a290bcdda3f0b729f7e3a9740736360c848e836b05da63d26718ef9c846 | Triage

Analysis

max time kernel
46s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 04:47

Sharing

Report Analysis Logs

General

Target

39c01a290bcdda3f0b729f7e3a9740736360c848e836b05da63d26718ef9c846.dll
Size

3KB
MD5

999f21d15cdc6985960ecf59d865a70b
SHA1

b9efb238946042a7659c0e656fb5816ecdf3f9e2
SHA256

39c01a290bcdda3f0b729f7e3a9740736360c848e836b05da63d26718ef9c846
SHA512

7f276496d5e05401a15d5bd87387d7fba539e39bedcf8f4d64ee10a63782ab371e39e826ac8364e64e248f601f11df7caca3a6c26b70e88048d22b2c61423b7d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 956	2016	rundll32.exe	27
PID 2016 wrote to memory of 956	2016	rundll32.exe	27
PID 2016 wrote to memory of 956	2016	rundll32.exe	27
PID 2016 wrote to memory of 956	2016	rundll32.exe	27
PID 2016 wrote to memory of 956	2016	rundll32.exe	27
PID 2016 wrote to memory of 956	2016	rundll32.exe	27
PID 2016 wrote to memory of 956	2016	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39c01a290bcdda3f0b729f7e3a9740736360c848e836b05da63d26718ef9c846.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\39c01a290bcdda3f0b729f7e3a9740736360c848e836b05da63d26718ef9c846.dll,#1
  2⤵
  PID:956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-55-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download