dfbb366d3baf00e417315b6c6a2942c3dcddb1649bf6a239d57cea0748f03ab5 | Triage

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14/10/2022, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dfbb366d3baf00e417315b6c6a2942c3dcddb1649bf6a239d57cea0748f03ab5.dll
Size

4KB
MD5

6b3e95e2d3571de1539a75311beda56d
SHA1

9ac029f2681ff767c39b0c2052436de35d970ce6
SHA256

dfbb366d3baf00e417315b6c6a2942c3dcddb1649bf6a239d57cea0748f03ab5
SHA512

2a6da84d022649a6bc0838ada02f82ace3ce862f07de33a21a87c0324cb5966b686e084792b7021f14cb28d77aa33fc49141caf5e9b3aad040e1da76248134e6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1708	1492	rundll32.exe	27
PID 1492 wrote to memory of 1708	1492	rundll32.exe	27
PID 1492 wrote to memory of 1708	1492	rundll32.exe	27
PID 1492 wrote to memory of 1708	1492	rundll32.exe	27
PID 1492 wrote to memory of 1708	1492	rundll32.exe	27
PID 1492 wrote to memory of 1708	1492	rundll32.exe	27
PID 1492 wrote to memory of 1708	1492	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfbb366d3baf00e417315b6c6a2942c3dcddb1649bf6a239d57cea0748f03ab5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfbb366d3baf00e417315b6c6a2942c3dcddb1649bf6a239d57cea0748f03ab5.dll,#1
  2⤵
  PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1708-55-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download