dd430855536230994c2b16b345e3e117253c8d05ea2cbde38e758314a86ec5c1 | Triage

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 21:25

Sharing

Report Analysis Logs

General

Target

dd430855536230994c2b16b345e3e117253c8d05ea2cbde38e758314a86ec5c1.dll
Size

3KB
MD5

0f5ddb6611a4c3c874ba8c8e93488750
SHA1

69e740ded9af4e544573a0a6e17d4edb8a3dbb6c
SHA256

dd430855536230994c2b16b345e3e117253c8d05ea2cbde38e758314a86ec5c1
SHA512

bd7fb44b164a1aaf19e70ec7c427580c81b2e4a7f7c0dd5aac03c4d54a95269758d6f3c01e2f61c48ba31a61cfd98fb7e34e233dbdf5e17482f8c781bcf90133

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1724	1672	rundll32.exe	27
PID 1672 wrote to memory of 1724	1672	rundll32.exe	27
PID 1672 wrote to memory of 1724	1672	rundll32.exe	27
PID 1672 wrote to memory of 1724	1672	rundll32.exe	27
PID 1672 wrote to memory of 1724	1672	rundll32.exe	27
PID 1672 wrote to memory of 1724	1672	rundll32.exe	27
PID 1672 wrote to memory of 1724	1672	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd430855536230994c2b16b345e3e117253c8d05ea2cbde38e758314a86ec5c1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd430855536230994c2b16b345e3e117253c8d05ea2cbde38e758314a86ec5c1.dll,#1
  2⤵
  PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-55-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download