4c5372cc80a0fbaa173803f4f8eb02dacabe650f1382805dbd957cb81a8e1436 | Triage

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4c5372cc80a0fbaa173803f4f8eb02dacabe650f1382805dbd957cb81a8e1436.dll
Size

3KB
MD5

614b641f5ba76223d8bc560c4cadc860
SHA1

ff00e85f1d02db4bc57e97b7b45ce8ac099b1ef5
SHA256

4c5372cc80a0fbaa173803f4f8eb02dacabe650f1382805dbd957cb81a8e1436
SHA512

4b31d1716be0667c52462d75b017f30df40aaf0d9988cd39eb982930e8ba28c2fc1fe59b5c9d7abb2561fe06e259a7c0b406e952d7f25b181edc0a119f48de17

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 288	1412	rundll32.exe	27
PID 1412 wrote to memory of 288	1412	rundll32.exe	27
PID 1412 wrote to memory of 288	1412	rundll32.exe	27
PID 1412 wrote to memory of 288	1412	rundll32.exe	27
PID 1412 wrote to memory of 288	1412	rundll32.exe	27
PID 1412 wrote to memory of 288	1412	rundll32.exe	27
PID 1412 wrote to memory of 288	1412	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c5372cc80a0fbaa173803f4f8eb02dacabe650f1382805dbd957cb81a8e1436.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c5372cc80a0fbaa173803f4f8eb02dacabe650f1382805dbd957cb81a8e1436.dll,#1
  2⤵
  PID:288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/288-55-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download