9259c384261f465a4fd9d3b39e440851f620fce9c5fcb983b6963a50371158cb | Triage

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 07:00

Sharing

Report Analysis Logs

General

Target

9259c384261f465a4fd9d3b39e440851f620fce9c5fcb983b6963a50371158cb.dll
Size

3KB
MD5

47e1f9589c58005c0e1975886ee85868
SHA1

fc89928df11afb73140ab236aab493d027dbc1a3
SHA256

9259c384261f465a4fd9d3b39e440851f620fce9c5fcb983b6963a50371158cb
SHA512

d9f0781ee07f8322b537650825354c0a79a4d2bd3c3d769fc53d61ad251efdc167c4ac028d4bf4e9563704b6cd4c7000a62e7363987bd8a7764262d6a08acb63

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 1708	620	rundll32.exe	27
PID 620 wrote to memory of 1708	620	rundll32.exe	27
PID 620 wrote to memory of 1708	620	rundll32.exe	27
PID 620 wrote to memory of 1708	620	rundll32.exe	27
PID 620 wrote to memory of 1708	620	rundll32.exe	27
PID 620 wrote to memory of 1708	620	rundll32.exe	27
PID 620 wrote to memory of 1708	620	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9259c384261f465a4fd9d3b39e440851f620fce9c5fcb983b6963a50371158cb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9259c384261f465a4fd9d3b39e440851f620fce9c5fcb983b6963a50371158cb.dll,#1
  2⤵
  PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1708-55-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download