9994a166f0ba46c22e166193b332f70c65beaf7e9f468987be86a23888ccba25 | Triage

Analysis

max time kernel
35s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 07:00

Sharing

Report Analysis Logs

General

Target

9994a166f0ba46c22e166193b332f70c65beaf7e9f468987be86a23888ccba25.dll
Size

3KB
MD5

6abda48cc851c07fdc64c9c6f5353e1f
SHA1

12fbcbe2f5127f43ecc7b193688d8b5afa8336aa
SHA256

9994a166f0ba46c22e166193b332f70c65beaf7e9f468987be86a23888ccba25
SHA512

7b0179d91da452af8da09430f0960a2adfd6925a286852c9a021aa6d5baa5fca7a9173aada0386409c24fad12989589cf7da83761fd30502838938dc0cc45ea5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1124	1168	rundll32.exe	27
PID 1168 wrote to memory of 1124	1168	rundll32.exe	27
PID 1168 wrote to memory of 1124	1168	rundll32.exe	27
PID 1168 wrote to memory of 1124	1168	rundll32.exe	27
PID 1168 wrote to memory of 1124	1168	rundll32.exe	27
PID 1168 wrote to memory of 1124	1168	rundll32.exe	27
PID 1168 wrote to memory of 1124	1168	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9994a166f0ba46c22e166193b332f70c65beaf7e9f468987be86a23888ccba25.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9994a166f0ba46c22e166193b332f70c65beaf7e9f468987be86a23888ccba25.dll,#1
  2⤵
  PID:1124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1124-55-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download