00b8a185e7536c332adddb14eed8e1746e145520eb9a427ba703fa6d6a7c01d5 | Triage

Analysis

max time kernel
57s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 15:06

Sharing

Report Analysis Logs

General

Target

00b8a185e7536c332adddb14eed8e1746e145520eb9a427ba703fa6d6a7c01d5.dll
Size

4KB
MD5

80209a4462c3e9cc3bf4195d8e3d2df6
SHA1

60a43b707d91fb3af282741c43706c691655c5c8
SHA256

00b8a185e7536c332adddb14eed8e1746e145520eb9a427ba703fa6d6a7c01d5
SHA512

efac3e0a15c7e1283771816950167f8c5b08270481611301459a061bc82d02c48f36664fd9d637f4b3be30766baf37c2893a5fe9c0b4b8173621e65388d52fb5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1396	1204	rundll32.exe	27
PID 1204 wrote to memory of 1396	1204	rundll32.exe	27
PID 1204 wrote to memory of 1396	1204	rundll32.exe	27
PID 1204 wrote to memory of 1396	1204	rundll32.exe	27
PID 1204 wrote to memory of 1396	1204	rundll32.exe	27
PID 1204 wrote to memory of 1396	1204	rundll32.exe	27
PID 1204 wrote to memory of 1396	1204	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00b8a185e7536c332adddb14eed8e1746e145520eb9a427ba703fa6d6a7c01d5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\00b8a185e7536c332adddb14eed8e1746e145520eb9a427ba703fa6d6a7c01d5.dll,#1
  2⤵
  PID:1396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1396-55-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download