c5564a085b81952206fc7aa4897d45dc0aaa64e285a3a654315f8b550456d8ac | Triage

Analysis

max time kernel
33s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c5564a085b81952206fc7aa4897d45dc0aaa64e285a3a654315f8b550456d8ac.dll
Size

4KB
MD5

4d7d749a9fe8aea59f125521922f469e
SHA1

a6ef8b89eaf765990ebf77eb8602b004b8547406
SHA256

c5564a085b81952206fc7aa4897d45dc0aaa64e285a3a654315f8b550456d8ac
SHA512

78a538d85e0a5eecbe03ee6c7e6e7717071a1914729bcdfcc4b093d4d3ddd87b3637552d96167d768aa520e97b4278eaae85e8a8d6dba6e8f80182b700d029f3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1644	1884	rundll32.exe	28
PID 1884 wrote to memory of 1644	1884	rundll32.exe	28
PID 1884 wrote to memory of 1644	1884	rundll32.exe	28
PID 1884 wrote to memory of 1644	1884	rundll32.exe	28
PID 1884 wrote to memory of 1644	1884	rundll32.exe	28
PID 1884 wrote to memory of 1644	1884	rundll32.exe	28
PID 1884 wrote to memory of 1644	1884	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5564a085b81952206fc7aa4897d45dc0aaa64e285a3a654315f8b550456d8ac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5564a085b81952206fc7aa4897d45dc0aaa64e285a3a654315f8b550456d8ac.dll,#1
  2⤵
  PID:1644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1644-55-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download