a9f34258d1bd92b80d7aa40b7b6b931caacbbdfe4f3dc1330b4f42fae684f425 | Triage

Analysis

max time kernel
38s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 16:45

Sharing

Report Analysis Logs

General

Target

a9f34258d1bd92b80d7aa40b7b6b931caacbbdfe4f3dc1330b4f42fae684f425.dll
Size

3KB
MD5

6aec641003ad58b383986a38e2196483
SHA1

f2833dc5de86eb5a7c1455cf39ffeabf111390f7
SHA256

a9f34258d1bd92b80d7aa40b7b6b931caacbbdfe4f3dc1330b4f42fae684f425
SHA512

45b9baacb56ae10dedfa7a04872ebc778fb1a5031778de16fdc830c6aa98c60ff738a81405536b0639c3ffd929c82e104034728550f1572ac6e57f4e64777bd2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 948	1628	rundll32.exe	16
PID 1628 wrote to memory of 948	1628	rundll32.exe	16
PID 1628 wrote to memory of 948	1628	rundll32.exe	16
PID 1628 wrote to memory of 948	1628	rundll32.exe	16
PID 1628 wrote to memory of 948	1628	rundll32.exe	16
PID 1628 wrote to memory of 948	1628	rundll32.exe	16
PID 1628 wrote to memory of 948	1628	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9f34258d1bd92b80d7aa40b7b6b931caacbbdfe4f3dc1330b4f42fae684f425.dll,#1
1⤵
PID:948

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9f34258d1bd92b80d7aa40b7b6b931caacbbdfe4f3dc1330b4f42fae684f425.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/948-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download