46d6ef284b4d9b1494d0ae00f7ddc1abb43e4a748373fdfd2c9957e4c29b35e4 | Triage

Analysis

max time kernel
35s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 04:48

Sharing

Report Analysis Logs

General

Target

46d6ef284b4d9b1494d0ae00f7ddc1abb43e4a748373fdfd2c9957e4c29b35e4.dll
Size

3KB
MD5

ef52827d758581317a7da8bf39723b3f
SHA1

9e1da50274d294c449b25047ac77c030c44438a8
SHA256

46d6ef284b4d9b1494d0ae00f7ddc1abb43e4a748373fdfd2c9957e4c29b35e4
SHA512

758e51bb7aacd6bf0b6ecd4bc41786b3a686986ce4a3bf1de53521d6e21d3183748895f179213a3cb9312109525c84d07759a53287f8ffd011642dde708e140b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 996	1456	rundll32.exe	27
PID 1456 wrote to memory of 996	1456	rundll32.exe	27
PID 1456 wrote to memory of 996	1456	rundll32.exe	27
PID 1456 wrote to memory of 996	1456	rundll32.exe	27
PID 1456 wrote to memory of 996	1456	rundll32.exe	27
PID 1456 wrote to memory of 996	1456	rundll32.exe	27
PID 1456 wrote to memory of 996	1456	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46d6ef284b4d9b1494d0ae00f7ddc1abb43e4a748373fdfd2c9957e4c29b35e4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\46d6ef284b4d9b1494d0ae00f7ddc1abb43e4a748373fdfd2c9957e4c29b35e4.dll,#1
  2⤵
  PID:996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/996-55-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download