91691df9724620e2c005af0f2f07144de755ed9a5cb79e2c162bf9bfe0d099c2 | Triage

Analysis

max time kernel
38s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 01:10

Sharing

Report Analysis Logs

General

Target

91691df9724620e2c005af0f2f07144de755ed9a5cb79e2c162bf9bfe0d099c2.dll
Size

3KB
MD5

260586af78f1e9af6b89409946746580
SHA1

e69221e4d4aba084fdb9d2a25391cb3b59ab3a68
SHA256

91691df9724620e2c005af0f2f07144de755ed9a5cb79e2c162bf9bfe0d099c2
SHA512

fb7d6f547e6cb0c94136a3ab35bdbf18b77232a3da0a19aecdb38d80194b5baed3048902930b74a9ffcd525c85b129693d1c74125ab00a423c232252dcc07f7d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\91691df9724620e2c005af0f2f07144de755ed9a5cb79e2c162bf9bfe0d099c2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\91691df9724620e2c005af0f2f07144de755ed9a5cb79e2c162bf9bfe0d099c2.dll,#1
  2⤵
  PID:1076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1076-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download