222dfcd0eaa6f5dad7971a7b4204ad93dd68a92c1096fbe6220260bc02ffd8fa | Triage

Analysis

max time kernel
37s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 10:37

Sharing

Report Analysis Logs

General

Target

222dfcd0eaa6f5dad7971a7b4204ad93dd68a92c1096fbe6220260bc02ffd8fa.dll
Size

3KB
MD5

80a560265196d174f3023712f48a803a
SHA1

e46e0b06624de2e257d5cd610545072ad2168750
SHA256

222dfcd0eaa6f5dad7971a7b4204ad93dd68a92c1096fbe6220260bc02ffd8fa
SHA512

4931f9fbfa6c664110f8aaeed888fcb19c582038dba86f30ed4553e3378f779c0e77c900cccae3c818772d229413e8a012ffc5c81cb46d6c5cbd2744734c9f4d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 1128	620	rundll32.exe	27
PID 620 wrote to memory of 1128	620	rundll32.exe	27
PID 620 wrote to memory of 1128	620	rundll32.exe	27
PID 620 wrote to memory of 1128	620	rundll32.exe	27
PID 620 wrote to memory of 1128	620	rundll32.exe	27
PID 620 wrote to memory of 1128	620	rundll32.exe	27
PID 620 wrote to memory of 1128	620	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\222dfcd0eaa6f5dad7971a7b4204ad93dd68a92c1096fbe6220260bc02ffd8fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\222dfcd0eaa6f5dad7971a7b4204ad93dd68a92c1096fbe6220260bc02ffd8fa.dll,#1
  2⤵
  PID:1128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1128-55-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download