dab17e35a1209680afd76f89b24144064a344f4f9c1099c1c33727267e943a6a | Triage

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 15:48

Sharing

Report Analysis Logs

General

Target

dab17e35a1209680afd76f89b24144064a344f4f9c1099c1c33727267e943a6a.dll
Size

3KB
MD5

6742389f57df1996ecc072bce8467409
SHA1

4377166975628d5ed577c6eb5e2dcd7033d966ea
SHA256

dab17e35a1209680afd76f89b24144064a344f4f9c1099c1c33727267e943a6a
SHA512

d02431aa507e32c5f814c237fbba7e73eb246937ee8b42aaff4b8e915d8077a7af093811116dcad3c00e8c03e4fe7098d3daf28ea8cc1de201bee4c0dc597d43

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1948	1444	rundll32.exe	27
PID 1444 wrote to memory of 1948	1444	rundll32.exe	27
PID 1444 wrote to memory of 1948	1444	rundll32.exe	27
PID 1444 wrote to memory of 1948	1444	rundll32.exe	27
PID 1444 wrote to memory of 1948	1444	rundll32.exe	27
PID 1444 wrote to memory of 1948	1444	rundll32.exe	27
PID 1444 wrote to memory of 1948	1444	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dab17e35a1209680afd76f89b24144064a344f4f9c1099c1c33727267e943a6a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dab17e35a1209680afd76f89b24144064a344f4f9c1099c1c33727267e943a6a.dll,#1
  2⤵
  PID:1948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1948-55-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download