def4eedf431365964596deaf6c92365d9cf7952baa5eda5867b4e7614fd8a8dd | Triage

Analysis

max time kernel
40s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09/10/2022, 07:37

Sharing

Report Analysis Logs

General

Target

Tools/imdisk/cpl/i386/imdisk.dll
Size

106KB
MD5

085a36ed3c2cfe0908dfb74118ba7467
SHA1

c939134ae26c785eccba28e8f90c7ac88be28ef2
SHA256

d66971aa7cd8c325ec86fe7efc72ea935a8de6f90a47c29bfaa3cb8797d69471
SHA512

c0202bfe967ec285c2d225ecc8a8cc054186ab404a055ad1b3ae3b93127a270769a1374347c8f66fa524f1c0795bd616ea59ba67f61c6a7d694b2f061ad74740
SSDEEP

3072:Os7sUst+sYO0CTKP7gDN12kZtt9EttteX:OAPUDukZtt9Ettte

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1448	1708	rundll32.exe	27
PID 1708 wrote to memory of 1448	1708	rundll32.exe	27
PID 1708 wrote to memory of 1448	1708	rundll32.exe	27
PID 1708 wrote to memory of 1448	1708	rundll32.exe	27
PID 1708 wrote to memory of 1448	1708	rundll32.exe	27
PID 1708 wrote to memory of 1448	1708	rundll32.exe	27
PID 1708 wrote to memory of 1448	1708	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Tools\imdisk\cpl\i386\imdisk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Tools\imdisk\cpl\i386\imdisk.dll,#1
  2⤵
  PID:1448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1448-55-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download