db4ef33c1848b7796e670a4694c250aca5cefdd3cb7ed7e46e23d3c0f329c5ba | Triage

Analysis

max time kernel
33s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 21:10

Sharing

Report Analysis Logs

General

Target

db4ef33c1848b7796e670a4694c250aca5cefdd3cb7ed7e46e23d3c0f329c5ba.dll
Size

3KB
MD5

4a39106c8a285514f80a53fc467b5e60
SHA1

169c7dfef1815a078c1b73649a3bcd21cef276cb
SHA256

db4ef33c1848b7796e670a4694c250aca5cefdd3cb7ed7e46e23d3c0f329c5ba
SHA512

a562715377e20a6ff629c275b5850bcb59cf147ff2d7aa0296dbc71f8b839dbf8af7b2fcdd6fa7d75f251c36af48afdcf183a46769d34cca8be1f676ae6cb518

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1892	900	rundll32.exe	27
PID 900 wrote to memory of 1892	900	rundll32.exe	27
PID 900 wrote to memory of 1892	900	rundll32.exe	27
PID 900 wrote to memory of 1892	900	rundll32.exe	27
PID 900 wrote to memory of 1892	900	rundll32.exe	27
PID 900 wrote to memory of 1892	900	rundll32.exe	27
PID 900 wrote to memory of 1892	900	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\db4ef33c1848b7796e670a4694c250aca5cefdd3cb7ed7e46e23d3c0f329c5ba.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\db4ef33c1848b7796e670a4694c250aca5cefdd3cb7ed7e46e23d3c0f329c5ba.dll,#1
  2⤵
  PID:1892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1892-55-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download