e118183459bd28fa436bfd756a5347a2a03a24e26c201dd0334d8e8524fb92f4 | Triage

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 06:43

Sharing

Report Analysis Logs

General

Target

e118183459bd28fa436bfd756a5347a2a03a24e26c201dd0334d8e8524fb92f4.dll
Size

3KB
MD5

6792b8cf88c5e881145581dd258b2061
SHA1

1b731b99da845847cc031b6c765059ef3028a3a6
SHA256

e118183459bd28fa436bfd756a5347a2a03a24e26c201dd0334d8e8524fb92f4
SHA512

5c1723adc65229e3e58296c6519ab5836e76093ec9723e79cd991770914295b2614b719c1d1d5c06dd869d5838dc04edd7d862d82939cd3d09361603efb90b2c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e118183459bd28fa436bfd756a5347a2a03a24e26c201dd0334d8e8524fb92f4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e118183459bd28fa436bfd756a5347a2a03a24e26c201dd0334d8e8524fb92f4.dll,#1
  2⤵
  PID:1036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1036-55-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download