bb2f8a4766c50060a7216821621f499b5500edb9ff42f380eff9f6712cf75561 | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 16:47

Sharing

Report Analysis Logs

General

Target

bb2f8a4766c50060a7216821621f499b5500edb9ff42f380eff9f6712cf75561.dll
Size

4KB
MD5

12b85a800a3e45b09458f0682e4ac90b
SHA1

f48d96ed829269db41bfc1e1d6787122aa982564
SHA256

bb2f8a4766c50060a7216821621f499b5500edb9ff42f380eff9f6712cf75561
SHA512

58dab79b357513872e6b596ecb8b522aa74eca2f8e0be83bc13edbaa413b766439bfbe1660e493378d7cbb77da0323070226c10a6ca08bf63fc0e6d00fcfb505

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1832	1100	rundll32.exe	28
PID 1100 wrote to memory of 1832	1100	rundll32.exe	28
PID 1100 wrote to memory of 1832	1100	rundll32.exe	28
PID 1100 wrote to memory of 1832	1100	rundll32.exe	28
PID 1100 wrote to memory of 1832	1100	rundll32.exe	28
PID 1100 wrote to memory of 1832	1100	rundll32.exe	28
PID 1100 wrote to memory of 1832	1100	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb2f8a4766c50060a7216821621f499b5500edb9ff42f380eff9f6712cf75561.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb2f8a4766c50060a7216821621f499b5500edb9ff42f380eff9f6712cf75561.dll,#1
  2⤵
  PID:1832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1832-54-0x0000000000000000-mapping.dmp

Download
memory/1832-55-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download