27f7396de925f7ab47e3d98acf0039afba2cd960a38f42379d14f43004af4627 | Triage

Analysis

max time kernel
40s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 07:03

Sharing

Report Analysis Logs

General

Target

27f7396de925f7ab47e3d98acf0039afba2cd960a38f42379d14f43004af4627.dll
Size

3KB
MD5

66d14df76183367395b6c3c39c804280
SHA1

7dbe67f0b2927451a36fc4ea3d71f06c210efade
SHA256

27f7396de925f7ab47e3d98acf0039afba2cd960a38f42379d14f43004af4627
SHA512

507c2f337e6023b14ebf09aa1a9226a553d8a2e008391732af604ee5dbe82478595d5469a1dd325173a08e3eebb4331d1813ccd5da04dc0ae99251e17ab08784

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1284	2028	rundll32.exe	28
PID 2028 wrote to memory of 1284	2028	rundll32.exe	28
PID 2028 wrote to memory of 1284	2028	rundll32.exe	28
PID 2028 wrote to memory of 1284	2028	rundll32.exe	28
PID 2028 wrote to memory of 1284	2028	rundll32.exe	28
PID 2028 wrote to memory of 1284	2028	rundll32.exe	28
PID 2028 wrote to memory of 1284	2028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27f7396de925f7ab47e3d98acf0039afba2cd960a38f42379d14f43004af4627.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\27f7396de925f7ab47e3d98acf0039afba2cd960a38f42379d14f43004af4627.dll,#1
  2⤵
  PID:1284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1284-54-0x0000000000000000-mapping.dmp

Download
memory/1284-55-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download