cf10e71baa79137f9d1b412b6597abc14d8cac1f21e9094c6df57ce8c988fe46 | Triage

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 20:43

Sharing

Report Analysis Logs

General

Target

cf10e71baa79137f9d1b412b6597abc14d8cac1f21e9094c6df57ce8c988fe46.dll
Size

3KB
MD5

922cddb6e087378e6621eda191b09140
SHA1

ee48b7951c44b34b493616ca64f291862ea3da7d
SHA256

cf10e71baa79137f9d1b412b6597abc14d8cac1f21e9094c6df57ce8c988fe46
SHA512

78abe0b3e98992bddd7816be2639afe2638bc20816ad7171e168ab7d8716306874c8870639213f22125b51740113d5c6118f2b80eadc5bee1fe9d3378a518620

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 536	1944	rundll32.exe	27
PID 1944 wrote to memory of 536	1944	rundll32.exe	27
PID 1944 wrote to memory of 536	1944	rundll32.exe	27
PID 1944 wrote to memory of 536	1944	rundll32.exe	27
PID 1944 wrote to memory of 536	1944	rundll32.exe	27
PID 1944 wrote to memory of 536	1944	rundll32.exe	27
PID 1944 wrote to memory of 536	1944	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf10e71baa79137f9d1b412b6597abc14d8cac1f21e9094c6df57ce8c988fe46.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf10e71baa79137f9d1b412b6597abc14d8cac1f21e9094c6df57ce8c988fe46.dll,#1
  2⤵
  PID:536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-55-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download