af1bdfc636735f3b106acbdbcfa0c82d6f026794ebfe9a28a56e20128eac2833 | Triage

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 00:49

Sharing

Report Analysis Logs

General

Target

af1bdfc636735f3b106acbdbcfa0c82d6f026794ebfe9a28a56e20128eac2833.dll
Size

4KB
MD5

92b43e3a62ec4dca2e6a237f3511e147
SHA1

ca80ffb0183b607330c821eb817b33ebf781e37f
SHA256

af1bdfc636735f3b106acbdbcfa0c82d6f026794ebfe9a28a56e20128eac2833
SHA512

88b8722272db33e6e677cf44f38edae616683c10effc6636f900a223d831f3f5be60096798f72f14c8aa8b7f5e3642bee8969a6763608c0a57f5195861cde366

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1448	1708	rundll32.exe	27
PID 1708 wrote to memory of 1448	1708	rundll32.exe	27
PID 1708 wrote to memory of 1448	1708	rundll32.exe	27
PID 1708 wrote to memory of 1448	1708	rundll32.exe	27
PID 1708 wrote to memory of 1448	1708	rundll32.exe	27
PID 1708 wrote to memory of 1448	1708	rundll32.exe	27
PID 1708 wrote to memory of 1448	1708	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af1bdfc636735f3b106acbdbcfa0c82d6f026794ebfe9a28a56e20128eac2833.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\af1bdfc636735f3b106acbdbcfa0c82d6f026794ebfe9a28a56e20128eac2833.dll,#1
  2⤵
  PID:1448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1448-55-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download