33eb3f51a6c95cfaef410913cf7be0843ca6493838f07cd3ac5b21a02513c6d4 | Triage

Analysis

max time kernel
45s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 05:02

Sharing

Report Analysis Logs

General

Target

33eb3f51a6c95cfaef410913cf7be0843ca6493838f07cd3ac5b21a02513c6d4.dll
Size

3KB
MD5

4962a276d50fddc566fec98c9ecebf01
SHA1

232c1c15943d4165130b040b7c6e6efa4b21d4b4
SHA256

33eb3f51a6c95cfaef410913cf7be0843ca6493838f07cd3ac5b21a02513c6d4
SHA512

cd68f92fb5fd9e97ab342d6303d1239f02076c6eed0a162cd0420b647f31992e23128999a276f999d8da75d7419cad1a420913c8194433860c10159325dfef9a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1228	1340	rundll32.exe	27
PID 1340 wrote to memory of 1228	1340	rundll32.exe	27
PID 1340 wrote to memory of 1228	1340	rundll32.exe	27
PID 1340 wrote to memory of 1228	1340	rundll32.exe	27
PID 1340 wrote to memory of 1228	1340	rundll32.exe	27
PID 1340 wrote to memory of 1228	1340	rundll32.exe	27
PID 1340 wrote to memory of 1228	1340	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33eb3f51a6c95cfaef410913cf7be0843ca6493838f07cd3ac5b21a02513c6d4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\33eb3f51a6c95cfaef410913cf7be0843ca6493838f07cd3ac5b21a02513c6d4.dll,#1
  2⤵
  PID:1228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1228-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download