32cda27c308686bb36c9ff27bf1df7b7c553a3f64a24315286bc489c12282607 | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 05:04

Sharing

Report Analysis Logs

General

Target

32cda27c308686bb36c9ff27bf1df7b7c553a3f64a24315286bc489c12282607.dll
Size

3KB
MD5

4b77f1332cb5cc8e67f8db9638aadca6
SHA1

021f71f71cd86499043cb5046ce30e5fd691f267
SHA256

32cda27c308686bb36c9ff27bf1df7b7c553a3f64a24315286bc489c12282607
SHA512

fdb3488be150f58d848f007e49bde01f04513ee2daae16d7ee51817dd34dcfb66bebfb1c050043cb77a4f0703659eff3c60e92df78389d6a5b269e25ca06afda

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 1792	864	rundll32.exe	28
PID 864 wrote to memory of 1792	864	rundll32.exe	28
PID 864 wrote to memory of 1792	864	rundll32.exe	28
PID 864 wrote to memory of 1792	864	rundll32.exe	28
PID 864 wrote to memory of 1792	864	rundll32.exe	28
PID 864 wrote to memory of 1792	864	rundll32.exe	28
PID 864 wrote to memory of 1792	864	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32cda27c308686bb36c9ff27bf1df7b7c553a3f64a24315286bc489c12282607.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32cda27c308686bb36c9ff27bf1df7b7c553a3f64a24315286bc489c12282607.dll,#1
  2⤵
  PID:1792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1792-55-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download