2470b39032f6182252039c88199016566b0de30c6aa02163a143427afedd12af | Triage

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-09-2022 12:07

Sharing

Report Analysis Logs

General

Target

test.dll
Size

52KB
MD5

c3a1924684ca30ed22234ce1d9111dfc
SHA1

7347706241422758c06440fd6044ae4e042b456b
SHA256

2470b39032f6182252039c88199016566b0de30c6aa02163a143427afedd12af
SHA512

f69431c68e9c4ddcd57782ee1d7a4f55720f384205a41120f79432857703e13caf64f2749e676f5771318a56f522ac3a13e35631c13bea1190477fc6d5b56171
SSDEEP

768:OeAoq02GPFDdHk79OFl/K24fwKTMDzGF8J4lbqM89eoiYvApq12cZ62Tys+:OR0h9DdExOrKx4RzGNls9fiY/1J8j

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1096	1456	rundll32.exe	26
PID 1456 wrote to memory of 1096	1456	rundll32.exe	26
PID 1456 wrote to memory of 1096	1456	rundll32.exe	26
PID 1456 wrote to memory of 1096	1456	rundll32.exe	26
PID 1456 wrote to memory of 1096	1456	rundll32.exe	26
PID 1456 wrote to memory of 1096	1456	rundll32.exe	26
PID 1456 wrote to memory of 1096	1456	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\test.dll,#1
  2⤵
  PID:1096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-54-0x0000000000000000-mapping.dmp

Download
memory/1096-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download