c2a5fd9f67f7416c749f50727dec3c0ccf7a7a2de845ee5552f3868b383c9232 | Triage

Analysis

max time kernel
30s
max time network
98s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 14:49

Sharing

Report Analysis Logs

General

Target

c2a5fd9f67f7416c749f50727dec3c0ccf7a7a2de845ee5552f3868b383c9232.dll
Size

3KB
MD5

a02ed269b3b0c8ef4d725e2925be739f
SHA1

db1de0d7fece42e0e153e3c3a65baefad7e5b192
SHA256

c2a5fd9f67f7416c749f50727dec3c0ccf7a7a2de845ee5552f3868b383c9232
SHA512

663d998f105e741876db6424a2fec56fdf9bd7ef847a29456ddd7c5fcabfb8cfc87ba021161706dc317c4389642ded36e0b24c7e6a0a52662f29826fff2fc264

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1488	1632	rundll32.exe	27
PID 1632 wrote to memory of 1488	1632	rundll32.exe	27
PID 1632 wrote to memory of 1488	1632	rundll32.exe	27
PID 1632 wrote to memory of 1488	1632	rundll32.exe	27
PID 1632 wrote to memory of 1488	1632	rundll32.exe	27
PID 1632 wrote to memory of 1488	1632	rundll32.exe	27
PID 1632 wrote to memory of 1488	1632	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c2a5fd9f67f7416c749f50727dec3c0ccf7a7a2de845ee5552f3868b383c9232.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c2a5fd9f67f7416c749f50727dec3c0ccf7a7a2de845ee5552f3868b383c9232.dll,#1
  2⤵
  PID:1488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-55-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download