b85df19ee703d12ba9ff25a9cf8f24174baa7c2cd811fd7d4f761f1cc33830e8 | Triage

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 14:49

Sharing

Report Analysis Logs

General

Target

b85df19ee703d12ba9ff25a9cf8f24174baa7c2cd811fd7d4f761f1cc33830e8.dll
Size

3KB
MD5

9660250857f6e1a4cc242208dbdeef26
SHA1

5a40c2b2671bf095383c1974dc4b4a50228c1c48
SHA256

b85df19ee703d12ba9ff25a9cf8f24174baa7c2cd811fd7d4f761f1cc33830e8
SHA512

7900bced1700da968ad47a4823bac9fdf72d177937b5610c540cc76405c576b1d2652a3dabba78679dee43d28d5ea5be7ad18355cbe402e43333281c33a40a69

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1496	1468	rundll32.exe	27
PID 1468 wrote to memory of 1496	1468	rundll32.exe	27
PID 1468 wrote to memory of 1496	1468	rundll32.exe	27
PID 1468 wrote to memory of 1496	1468	rundll32.exe	27
PID 1468 wrote to memory of 1496	1468	rundll32.exe	27
PID 1468 wrote to memory of 1496	1468	rundll32.exe	27
PID 1468 wrote to memory of 1496	1468	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b85df19ee703d12ba9ff25a9cf8f24174baa7c2cd811fd7d4f761f1cc33830e8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b85df19ee703d12ba9ff25a9cf8f24174baa7c2cd811fd7d4f761f1cc33830e8.dll,#1
  2⤵
  PID:1496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1496-54-0x0000000000000000-mapping.dmp

Download
memory/1496-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download