e0a3ec3471b305c23e4e68b92a053f51ee39bd107508a9b053b8af5d8098dabb | Triage

Analysis

max time kernel
36s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 01:09

Sharing

Report Analysis Logs

General

Target

e0a3ec3471b305c23e4e68b92a053f51ee39bd107508a9b053b8af5d8098dabb.dll
Size

3KB
MD5

11e3ab80ec2d47d4b610a1fe22385c20
SHA1

1c16dafcd403ab421763c7e7b03de6607e7df31c
SHA256

e0a3ec3471b305c23e4e68b92a053f51ee39bd107508a9b053b8af5d8098dabb
SHA512

4d244605c440a34af11c1e4a86b6ba7b1fed55356bf8e0775f1f1aa9f8a61a145efd8f7f7b331ffc049fda9a0d153e462e121b2ef1fdd23e361209a8f53f2637

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2020	2040	rundll32.exe	27
PID 2040 wrote to memory of 2020	2040	rundll32.exe	27
PID 2040 wrote to memory of 2020	2040	rundll32.exe	27
PID 2040 wrote to memory of 2020	2040	rundll32.exe	27
PID 2040 wrote to memory of 2020	2040	rundll32.exe	27
PID 2040 wrote to memory of 2020	2040	rundll32.exe	27
PID 2040 wrote to memory of 2020	2040	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0a3ec3471b305c23e4e68b92a053f51ee39bd107508a9b053b8af5d8098dabb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0a3ec3471b305c23e4e68b92a053f51ee39bd107508a9b053b8af5d8098dabb.dll,#1
  2⤵
  PID:2020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2020-54-0x0000000000000000-mapping.dmp

Download
memory/2020-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download