5703bb2056cc92f15330db78625ec3f336e5a895504eaca74ecf2a20049d0663 | Triage

Analysis

max time kernel
30s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 10:01

Sharing

Report Analysis Logs

General

Target

5703bb2056cc92f15330db78625ec3f336e5a895504eaca74ecf2a20049d0663.dll
Size

4KB
MD5

7a2d18567a6da73a0e4ca85c1a5f7f9e
SHA1

41d3cc5d369c2384eded986b35e8ce366dc96e91
SHA256

5703bb2056cc92f15330db78625ec3f336e5a895504eaca74ecf2a20049d0663
SHA512

f27517f928e899886b9fb6dd08bc81f2c114a0e192efd985bf1f31f49058b9b3567405fd43e7a8f641c82ba4a9ae0a7714711f1c0f762e351a753dd34fe7bfbc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 2000	1012	rundll32.exe	28
PID 1012 wrote to memory of 2000	1012	rundll32.exe	28
PID 1012 wrote to memory of 2000	1012	rundll32.exe	28
PID 1012 wrote to memory of 2000	1012	rundll32.exe	28
PID 1012 wrote to memory of 2000	1012	rundll32.exe	28
PID 1012 wrote to memory of 2000	1012	rundll32.exe	28
PID 1012 wrote to memory of 2000	1012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5703bb2056cc92f15330db78625ec3f336e5a895504eaca74ecf2a20049d0663.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5703bb2056cc92f15330db78625ec3f336e5a895504eaca74ecf2a20049d0663.dll,#1
  2⤵
  PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-55-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download