012098468caa36b731141ce41a8eac7a80da3fcbbebdf7f1e3040a1ddd22a183 | Triage

Analysis

max time kernel
20s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 14:51

Sharing

Report Analysis Logs

General

Target

012098468caa36b731141ce41a8eac7a80da3fcbbebdf7f1e3040a1ddd22a183.dll
Size

3KB
MD5

968856856f0c10b25912f2166345d848
SHA1

845eb648c16fe6a471fa96bb392d54cd90a7c453
SHA256

012098468caa36b731141ce41a8eac7a80da3fcbbebdf7f1e3040a1ddd22a183
SHA512

e8a2c9e6a2b9018a5574d7c982297f7f6f3653f6a684a511d728c579f9e4885dc2e6e712c295fc19f926105b8349c33eb723e702fa871145e5a5ef36b14b64ab

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 688 wrote to memory of 1656	688	rundll32.exe	28
PID 688 wrote to memory of 1656	688	rundll32.exe	28
PID 688 wrote to memory of 1656	688	rundll32.exe	28
PID 688 wrote to memory of 1656	688	rundll32.exe	28
PID 688 wrote to memory of 1656	688	rundll32.exe	28
PID 688 wrote to memory of 1656	688	rundll32.exe	28
PID 688 wrote to memory of 1656	688	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\012098468caa36b731141ce41a8eac7a80da3fcbbebdf7f1e3040a1ddd22a183.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\012098468caa36b731141ce41a8eac7a80da3fcbbebdf7f1e3040a1ddd22a183.dll,#1
  2⤵
  PID:1656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-55-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download