d1f2655f756c488a9421823a1a54432c3b54cf0ff67d251d7bc27bef08967f8a | Triage

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 21:51

Sharing

Report Analysis Logs

General

Target

d1f2655f756c488a9421823a1a54432c3b54cf0ff67d251d7bc27bef08967f8a.dll
Size

3KB
MD5

6f30729ed38755d62feb31f62d3e2679
SHA1

639e7c94f0434006c27fac4f86766f899561a4a1
SHA256

d1f2655f756c488a9421823a1a54432c3b54cf0ff67d251d7bc27bef08967f8a
SHA512

6b2e9ace812ffcdc1f211b19ad02685f4ea4eb6389ba661e1c749e9dda3a256a0c5f710ca5cb34f75df8e4a008f1ef093955004127c548cdafe76dc0423ec6dd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 896	1812	rundll32.exe	28
PID 1812 wrote to memory of 896	1812	rundll32.exe	28
PID 1812 wrote to memory of 896	1812	rundll32.exe	28
PID 1812 wrote to memory of 896	1812	rundll32.exe	28
PID 1812 wrote to memory of 896	1812	rundll32.exe	28
PID 1812 wrote to memory of 896	1812	rundll32.exe	28
PID 1812 wrote to memory of 896	1812	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d1f2655f756c488a9421823a1a54432c3b54cf0ff67d251d7bc27bef08967f8a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d1f2655f756c488a9421823a1a54432c3b54cf0ff67d251d7bc27bef08967f8a.dll,#1
  2⤵
  PID:896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/896-55-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download