ae6a6bd412bef8f0baeddb6871bf61e0e14c15a29d6947e5dd21a2c8c3c0fd10 | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-09-2022 11:42

Sharing

Report Analysis Logs

General

Target

1f0000.dll
Size

43KB
MD5

c5d5bbe7532ee239898246a31f110224
SHA1

bebf6d50a0ddc048efb4e6da7eb0cf42ff21680f
SHA256

ae6a6bd412bef8f0baeddb6871bf61e0e14c15a29d6947e5dd21a2c8c3c0fd10
SHA512

e6bf38a01af969964091a9a2a2f70fe71deb44842d3e7ed02d99e0a7ed34edaddb8fb8e3789b674741baea39111cc0e13f707ec11cf7a085d1693c93bfc026b5
SSDEEP

768:JibfzHdW3Q0Jfb7cY4ig5sfCQygT8bf1OTNFDMu+AFWHuA:e7HdgfncFig5sfCQyXz1OTbDMyYHuA

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 900 wrote to memory of 1416	900	rundll32.exe	27
PID 900 wrote to memory of 1416	900	rundll32.exe	27
PID 900 wrote to memory of 1416	900	rundll32.exe	27
PID 900 wrote to memory of 1416	900	rundll32.exe	27
PID 900 wrote to memory of 1416	900	rundll32.exe	27
PID 900 wrote to memory of 1416	900	rundll32.exe	27
PID 900 wrote to memory of 1416	900	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f0000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f0000.dll,#1
  2⤵
  PID:1416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1416-54-0x0000000000000000-mapping.dmp

Download
memory/1416-55-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download