98ecf67ac345c4291a06e28b2f7c9221f376dfc56e636ebbe4c253a0e0e1eb3f | Triage

Analysis

max time kernel
17s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/10/2022, 02:02

Sharing

Report Analysis Logs

General

Target

98ecf67ac345c4291a06e28b2f7c9221f376dfc56e636ebbe4c253a0e0e1eb3f.dll
Size

3KB
MD5

76226dd4001ec68ab66bfdbbf30f2ec4
SHA1

d33983bc1d50fb03cf0ca203253be11f9ad4fcbd
SHA256

98ecf67ac345c4291a06e28b2f7c9221f376dfc56e636ebbe4c253a0e0e1eb3f
SHA512

4c7529e5d0dc00b6b9a187f74a9b02377e8ed780d5df0863ff2dd1beef8975e0b9ddfda3fa7184bd6b1d93a2079981c3e7bb6e1e71f0a57453a40951331a98ea

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1372	1632	rundll32.exe	27
PID 1632 wrote to memory of 1372	1632	rundll32.exe	27
PID 1632 wrote to memory of 1372	1632	rundll32.exe	27
PID 1632 wrote to memory of 1372	1632	rundll32.exe	27
PID 1632 wrote to memory of 1372	1632	rundll32.exe	27
PID 1632 wrote to memory of 1372	1632	rundll32.exe	27
PID 1632 wrote to memory of 1372	1632	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\98ecf67ac345c4291a06e28b2f7c9221f376dfc56e636ebbe4c253a0e0e1eb3f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\98ecf67ac345c4291a06e28b2f7c9221f376dfc56e636ebbe4c253a0e0e1eb3f.dll,#1
  2⤵
  PID:1372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1372-55-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download