041341a6d831175cfb8fa32f812bf779724e4c03543543463eda8a0d0a7b7036 | Triage

Analysis

max time kernel
33s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 06:42

Sharing

Report Analysis Logs

General

Target

041341a6d831175cfb8fa32f812bf779724e4c03543543463eda8a0d0a7b7036.dll
Size

3KB
MD5

486f7eec5655fd8457434a15967b88e5
SHA1

1d22be47b138d8544f160170ab905bf524784637
SHA256

041341a6d831175cfb8fa32f812bf779724e4c03543543463eda8a0d0a7b7036
SHA512

5973065fba35ea0a42695c9542132045cbcf98a60830afd8c8b7a0aa67e2bad290c6bf560c5e5a30c7842c53f31cc0afacf698fe6b45a12ea0365212685a6649

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 1928	1116	rundll32.exe	28
PID 1116 wrote to memory of 1928	1116	rundll32.exe	28
PID 1116 wrote to memory of 1928	1116	rundll32.exe	28
PID 1116 wrote to memory of 1928	1116	rundll32.exe	28
PID 1116 wrote to memory of 1928	1116	rundll32.exe	28
PID 1116 wrote to memory of 1928	1116	rundll32.exe	28
PID 1116 wrote to memory of 1928	1116	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\041341a6d831175cfb8fa32f812bf779724e4c03543543463eda8a0d0a7b7036.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\041341a6d831175cfb8fa32f812bf779724e4c03543543463eda8a0d0a7b7036.dll,#1
  2⤵
  PID:1928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1928-55-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download