04e5878a81e9787297835a9a1f1df0b18bc8998620beffb14b24fe2476af329c | Triage

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 14:48

Sharing

Report Analysis Logs

General

Target

04e5878a81e9787297835a9a1f1df0b18bc8998620beffb14b24fe2476af329c.dll
Size

3KB
MD5

a064385203b8798db412a4c1d0298990
SHA1

ea924d414220686145834ff18efb24e2e76bdbd3
SHA256

04e5878a81e9787297835a9a1f1df0b18bc8998620beffb14b24fe2476af329c
SHA512

e963eaea8a4b3c211a4625880d989f5a2c845b33457d716a275adb61c336150b757cc6191ce2d339fa59dc22ff37c13ec8f8c14b77bc7f5104578ec36b9e923e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 304	1572	rundll32.exe	27
PID 1572 wrote to memory of 304	1572	rundll32.exe	27
PID 1572 wrote to memory of 304	1572	rundll32.exe	27
PID 1572 wrote to memory of 304	1572	rundll32.exe	27
PID 1572 wrote to memory of 304	1572	rundll32.exe	27
PID 1572 wrote to memory of 304	1572	rundll32.exe	27
PID 1572 wrote to memory of 304	1572	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04e5878a81e9787297835a9a1f1df0b18bc8998620beffb14b24fe2476af329c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\04e5878a81e9787297835a9a1f1df0b18bc8998620beffb14b24fe2476af329c.dll,#1
  2⤵
  PID:304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/304-55-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download