b11358da5c677ca2d83b378af191051b0373e382217ace70645cdc572cb3d019 | Triage

Analysis

max time kernel
39s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 12:56

Sharing

Report Analysis Logs

General

Target

b11358da5c677ca2d83b378af191051b0373e382217ace70645cdc572cb3d019.dll
Size

3KB
MD5

05a98a0d231b169efa16975fa604d7c7
SHA1

8d38dc1893d7dd78d97de674ae24ab173eeb55b2
SHA256

b11358da5c677ca2d83b378af191051b0373e382217ace70645cdc572cb3d019
SHA512

cc8cec4b052ae913163038d960a7d2b132ad10afa67d72564871405b20c881f76820a427461e878ebcd667acd164736a257953de288b4db556e6cb0b551151fc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1172	1584	rundll32.exe	26
PID 1584 wrote to memory of 1172	1584	rundll32.exe	26
PID 1584 wrote to memory of 1172	1584	rundll32.exe	26
PID 1584 wrote to memory of 1172	1584	rundll32.exe	26
PID 1584 wrote to memory of 1172	1584	rundll32.exe	26
PID 1584 wrote to memory of 1172	1584	rundll32.exe	26
PID 1584 wrote to memory of 1172	1584	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b11358da5c677ca2d83b378af191051b0373e382217ace70645cdc572cb3d019.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b11358da5c677ca2d83b378af191051b0373e382217ace70645cdc572cb3d019.dll,#1
  2⤵
  PID:1172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1172-54-0x0000000000000000-mapping.dmp

Download
memory/1172-55-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download