8932e3037069929459831a4d5f6ec8c930be911b237ce882096ca48ecb3ffc78 | Triage

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 18:00

Sharing

Report Analysis Logs

General

Target

8932e3037069929459831a4d5f6ec8c930be911b237ce882096ca48ecb3ffc78.dll
Size

3KB
MD5

82a4ae1380e5d88ae7b5b6dd23d8bce0
SHA1

e107f9f6efcce33ef3d3e0c83256eabbc4376d08
SHA256

8932e3037069929459831a4d5f6ec8c930be911b237ce882096ca48ecb3ffc78
SHA512

017f2c837a480f8d4e3a8774861aa5676af5520a5ff2cc03ac8c98275b2da61aa6005ce1ce54614c60dca96d4843727d30fbb316b954064efe7dbf80e1e4e76e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1720	1752	rundll32.exe	27
PID 1752 wrote to memory of 1720	1752	rundll32.exe	27
PID 1752 wrote to memory of 1720	1752	rundll32.exe	27
PID 1752 wrote to memory of 1720	1752	rundll32.exe	27
PID 1752 wrote to memory of 1720	1752	rundll32.exe	27
PID 1752 wrote to memory of 1720	1752	rundll32.exe	27
PID 1752 wrote to memory of 1720	1752	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8932e3037069929459831a4d5f6ec8c930be911b237ce882096ca48ecb3ffc78.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8932e3037069929459831a4d5f6ec8c930be911b237ce882096ca48ecb3ffc78.dll,#1
  2⤵
  PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-55-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download