cdb3ead932e8cd54fb1089a36eac6ef4a1f6119f8c78a6ba03566dda1a6c203f | Triage

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
21-10-2022 02:02

Sharing

Report Analysis Logs

General

Target

cdb3ead932e8cd54fb1089a36eac6ef4a1f6119f8c78a6ba03566dda1a6c203f.dll
Size

3KB
MD5

29a45e745bf5ded0fb95befaa8189767
SHA1

08db02ba810243072c13c3261204c2dc013fdf13
SHA256

cdb3ead932e8cd54fb1089a36eac6ef4a1f6119f8c78a6ba03566dda1a6c203f
SHA512

54ed536b329e34d91bc1cf516d0fd2dae27ff9fc6ff6be6efba83c5a898d2a8ca3ed0849ba0994d936d0006acd16797315bc40fa227cac305430f1eadb9c7b58

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 2012	1304	rundll32.exe	27
PID 1304 wrote to memory of 2012	1304	rundll32.exe	27
PID 1304 wrote to memory of 2012	1304	rundll32.exe	27
PID 1304 wrote to memory of 2012	1304	rundll32.exe	27
PID 1304 wrote to memory of 2012	1304	rundll32.exe	27
PID 1304 wrote to memory of 2012	1304	rundll32.exe	27
PID 1304 wrote to memory of 2012	1304	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cdb3ead932e8cd54fb1089a36eac6ef4a1f6119f8c78a6ba03566dda1a6c203f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cdb3ead932e8cd54fb1089a36eac6ef4a1f6119f8c78a6ba03566dda1a6c203f.dll,#1
  2⤵
  PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-55-0x00000000762E1000-0x00000000762E3000-memory.dmp

Filesize
8KB

Download