a4bff91e84ce550c2ca9031c09a60ba8576bc2a7468b7ebd1730a1c6ec76e960 | Triage

Analysis

max time kernel
37s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 05:26

Sharing

Report Analysis Logs

General

Target

a4bff91e84ce550c2ca9031c09a60ba8576bc2a7468b7ebd1730a1c6ec76e960.dll
Size

3KB
MD5

a30799ee3e112d07038607ce80a94ee0
SHA1

77c9fe6142d588203ff9aa3ce2f1985f592291ca
SHA256

a4bff91e84ce550c2ca9031c09a60ba8576bc2a7468b7ebd1730a1c6ec76e960
SHA512

5e8cc77c6778c97a20098e8e28b40b610557c01981c3ba62e96e01a8a2d58c16258ee4d50b7f53344b833ac0615097e89b475ec778ecf5d1ecce5ab622f0c7c6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4bff91e84ce550c2ca9031c09a60ba8576bc2a7468b7ebd1730a1c6ec76e960.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4bff91e84ce550c2ca9031c09a60ba8576bc2a7468b7ebd1730a1c6ec76e960.dll,#1
  2⤵
  PID:1460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1460-54-0x0000000000000000-mapping.dmp

Download
memory/1460-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download