fb5bc604d3dd49baf3879a3a78afa2a28281acedc3773dfa395f5886d5175cf7 | Triage

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 10:00

Sharing

Report Analysis Logs

General

Target

fb5bc604d3dd49baf3879a3a78afa2a28281acedc3773dfa395f5886d5175cf7.dll
Size

4KB
MD5

6facaf1e826db07f8f6ca13c78d24b8d
SHA1

c1e0104562f8b4eb2de6645d3fb247e76c4be959
SHA256

fb5bc604d3dd49baf3879a3a78afa2a28281acedc3773dfa395f5886d5175cf7
SHA512

12cc1a40cc813461bd6d55cba12a68ee199f741bd5ab4af40c78b0e8cdf39d8f14ea7653eaba4b4f6c5f0a829126ab93e7bcfc24dc72e8368fad1498be661201

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 108 wrote to memory of 872	108	rundll32.exe	27
PID 108 wrote to memory of 872	108	rundll32.exe	27
PID 108 wrote to memory of 872	108	rundll32.exe	27
PID 108 wrote to memory of 872	108	rundll32.exe	27
PID 108 wrote to memory of 872	108	rundll32.exe	27
PID 108 wrote to memory of 872	108	rundll32.exe	27
PID 108 wrote to memory of 872	108	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb5bc604d3dd49baf3879a3a78afa2a28281acedc3773dfa395f5886d5175cf7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb5bc604d3dd49baf3879a3a78afa2a28281acedc3773dfa395f5886d5175cf7.dll,#1
  2⤵
  PID:872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/872-55-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download