175f1195f4c0568992ace3b6b761901ff99ffda1d55ffd7577a57466b537d3bb | Triage

Analysis

max time kernel
36s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 16:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

175f1195f4c0568992ace3b6b761901ff99ffda1d55ffd7577a57466b537d3bb.dll
Size

3KB
MD5

83f6c99ba9c5d164b0b879f4ddfd4920
SHA1

a8a04c30f571f624d1265beefd89f96bd3efe324
SHA256

175f1195f4c0568992ace3b6b761901ff99ffda1d55ffd7577a57466b537d3bb
SHA512

38d6d7d412d9560329bc1da0e684a3dfd41aeea15e933ee5a9a107da750312874d17b178adf46723c571b2b9e956f495ae7cd396d57409907cff2cfd2aa0e5f1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 964	1488	rundll32.exe	28
PID 1488 wrote to memory of 964	1488	rundll32.exe	28
PID 1488 wrote to memory of 964	1488	rundll32.exe	28
PID 1488 wrote to memory of 964	1488	rundll32.exe	28
PID 1488 wrote to memory of 964	1488	rundll32.exe	28
PID 1488 wrote to memory of 964	1488	rundll32.exe	28
PID 1488 wrote to memory of 964	1488	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\175f1195f4c0568992ace3b6b761901ff99ffda1d55ffd7577a57466b537d3bb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\175f1195f4c0568992ace3b6b761901ff99ffda1d55ffd7577a57466b537d3bb.dll,#1
  2⤵
  PID:964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/964-55-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download