0db2b74bfe15b1168b114c729531037c52b343a268aabcf17794cc1010c1a798 | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 06:23

Sharing

Report Analysis Logs

General

Target

0db2b74bfe15b1168b114c729531037c52b343a268aabcf17794cc1010c1a798.dll
Size

3KB
MD5

1ca32213473ec85c887d08ff1b440f6c
SHA1

12b8b6275d80fb09dbd792c2ed5056edf3705c80
SHA256

0db2b74bfe15b1168b114c729531037c52b343a268aabcf17794cc1010c1a798
SHA512

ddecf915c1b66bdb73711994e1e9d3545ecd8e8e2a1c7f862914dacf8c3c7cea38219d65f63bac000d330f56ee06daaf129b2efadc163a893a326b95fe8f7d76

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1640	832	rundll32.exe	27
PID 832 wrote to memory of 1640	832	rundll32.exe	27
PID 832 wrote to memory of 1640	832	rundll32.exe	27
PID 832 wrote to memory of 1640	832	rundll32.exe	27
PID 832 wrote to memory of 1640	832	rundll32.exe	27
PID 832 wrote to memory of 1640	832	rundll32.exe	27
PID 832 wrote to memory of 1640	832	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0db2b74bfe15b1168b114c729531037c52b343a268aabcf17794cc1010c1a798.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0db2b74bfe15b1168b114c729531037c52b343a268aabcf17794cc1010c1a798.dll,#1
  2⤵
  PID:1640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1640-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download