af417e8346922808da70bc1a1e5d0aeec080f37d4b0af5f848783dd5a9f93eba | Triage

Analysis

max time kernel
42s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 05:25

Sharing

Report Analysis Logs

General

Target

af417e8346922808da70bc1a1e5d0aeec080f37d4b0af5f848783dd5a9f93eba.dll
Size

3KB
MD5

a305190e3d9e68213757905e0a0d8360
SHA1

f7780475a10ecea301b61cbf6c4846f2b52a3e67
SHA256

af417e8346922808da70bc1a1e5d0aeec080f37d4b0af5f848783dd5a9f93eba
SHA512

560c2168014fd6554dbee959dae00e1b8b06f81343a1558f3ce632f140a30098f6da2c9d3220d413dbf7b78ddb25d8e606fad8b1a3702df8eac72ee55aab9533

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1300	1720	rundll32.exe	27
PID 1720 wrote to memory of 1300	1720	rundll32.exe	27
PID 1720 wrote to memory of 1300	1720	rundll32.exe	27
PID 1720 wrote to memory of 1300	1720	rundll32.exe	27
PID 1720 wrote to memory of 1300	1720	rundll32.exe	27
PID 1720 wrote to memory of 1300	1720	rundll32.exe	27
PID 1720 wrote to memory of 1300	1720	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af417e8346922808da70bc1a1e5d0aeec080f37d4b0af5f848783dd5a9f93eba.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\af417e8346922808da70bc1a1e5d0aeec080f37d4b0af5f848783dd5a9f93eba.dll,#1
  2⤵
  PID:1300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1300-55-0x00000000765B1000-0x00000000765B3000-memory.dmp

Filesize
8KB

Download