24e0d7e31760475ccca622899e74987f6741248c0d6073661a571d6fa1fb444c | Triage

Analysis

max time kernel
27s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 04:57

Sharing

Report Analysis Logs

General

Target

24e0d7e31760475ccca622899e74987f6741248c0d6073661a571d6fa1fb444c.dll
Size

3KB
MD5

f5f79fe6cc2efb4d4349a73077b18367
SHA1

5450ab91162fdda7cb2406bedf05e537b86cbd07
SHA256

24e0d7e31760475ccca622899e74987f6741248c0d6073661a571d6fa1fb444c
SHA512

9cc00ae63affb790a000a2b969cdbeaf185205d22b435f55e7b1c59c0cd991f9af5f06894c673b6fca8fc9e53f3fc70a57e2740657b308638dca28e75113b273

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1620	1104	rundll32.exe	27
PID 1104 wrote to memory of 1620	1104	rundll32.exe	27
PID 1104 wrote to memory of 1620	1104	rundll32.exe	27
PID 1104 wrote to memory of 1620	1104	rundll32.exe	27
PID 1104 wrote to memory of 1620	1104	rundll32.exe	27
PID 1104 wrote to memory of 1620	1104	rundll32.exe	27
PID 1104 wrote to memory of 1620	1104	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24e0d7e31760475ccca622899e74987f6741248c0d6073661a571d6fa1fb444c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24e0d7e31760475ccca622899e74987f6741248c0d6073661a571d6fa1fb444c.dll,#1
  2⤵
  PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-54-0x0000000000000000-mapping.dmp

Download
memory/1620-55-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download