0b8e96ce56f5bba4e10da36750f751e2f9f29fdda0ecd4611f591818a3055a54 | Triage

Analysis

max time kernel
26s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 01:06

Sharing

Report Analysis Logs

General

Target

0b8e96ce56f5bba4e10da36750f751e2f9f29fdda0ecd4611f591818a3055a54.dll
Size

3KB
MD5

64db9fc67cecc295a5e733e0c5a24540
SHA1

8a27b4e5e750337edeabec0b08153c2387ccb82a
SHA256

0b8e96ce56f5bba4e10da36750f751e2f9f29fdda0ecd4611f591818a3055a54
SHA512

8c70b8d4545326bec3ec173fb89f17c4e76b32d09cadb03c184f7ae70f7ffa4f5a12b35f0eb605fb39913861a1d801775a215ab31f4948dee2759f41ce87b728

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1356	1912	rundll32.exe	28
PID 1912 wrote to memory of 1356	1912	rundll32.exe	28
PID 1912 wrote to memory of 1356	1912	rundll32.exe	28
PID 1912 wrote to memory of 1356	1912	rundll32.exe	28
PID 1912 wrote to memory of 1356	1912	rundll32.exe	28
PID 1912 wrote to memory of 1356	1912	rundll32.exe	28
PID 1912 wrote to memory of 1356	1912	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b8e96ce56f5bba4e10da36750f751e2f9f29fdda0ecd4611f591818a3055a54.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b8e96ce56f5bba4e10da36750f751e2f9f29fdda0ecd4611f591818a3055a54.dll,#1
  2⤵
  PID:1356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1356-54-0x0000000000000000-mapping.dmp

Download
memory/1356-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download