8516540128949aab4fad8e7cce9cf1f1b133b16f3b69c0c482fa1f96cfba4351 | Triage

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 16:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8516540128949aab4fad8e7cce9cf1f1b133b16f3b69c0c482fa1f96cfba4351.dll
Size

3KB
MD5

845f542308c670dc55d39fdd855f4f50
SHA1

c28e8d215627c3341d71e1fb306b2d33dd963ee7
SHA256

8516540128949aab4fad8e7cce9cf1f1b133b16f3b69c0c482fa1f96cfba4351
SHA512

cda9187b76b1e58c0e3e54dfddffa408ebee2d82c13f744ded364391c97107753b4afb62c2a0b3ed21ad99e7b56fdcf2dc72ce2a3a804b0f1da898b99040317b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8516540128949aab4fad8e7cce9cf1f1b133b16f3b69c0c482fa1f96cfba4351.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8516540128949aab4fad8e7cce9cf1f1b133b16f3b69c0c482fa1f96cfba4351.dll,#1
  2⤵
  PID:1036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1036-55-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download