1f8a6b9f85d91f07c8f79d5bf8e83b43d1d071189c7c30890c60809caf15fc27 | Triage

Analysis

max time kernel
34s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 05:27

Sharing

Report Analysis Logs

General

Target

1f8a6b9f85d91f07c8f79d5bf8e83b43d1d071189c7c30890c60809caf15fc27.dll
Size

3KB
MD5

84db11696a8db5baa6f3e5e5d71e45e0
SHA1

441d3cd76ed73c36c0fdf96691f2436ef88cf527
SHA256

1f8a6b9f85d91f07c8f79d5bf8e83b43d1d071189c7c30890c60809caf15fc27
SHA512

d38dea1fa36d68e543f009f96fe4add5b58b3dd30eff3bd8fee14b7b45377ca1238a266f019716e0d986c28d6c382052d87da9d20533c09e850221563f97ed9a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 1904	968	rundll32.exe	28
PID 968 wrote to memory of 1904	968	rundll32.exe	28
PID 968 wrote to memory of 1904	968	rundll32.exe	28
PID 968 wrote to memory of 1904	968	rundll32.exe	28
PID 968 wrote to memory of 1904	968	rundll32.exe	28
PID 968 wrote to memory of 1904	968	rundll32.exe	28
PID 968 wrote to memory of 1904	968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f8a6b9f85d91f07c8f79d5bf8e83b43d1d071189c7c30890c60809caf15fc27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f8a6b9f85d91f07c8f79d5bf8e83b43d1d071189c7c30890c60809caf15fc27.dll,#1
  2⤵
  PID:1904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1904-55-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download