759db21bceda4d3a7fa8e3e1075a4385f2cc58e9638d489a742b924c92037df6 | Triage

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 21:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

759db21bceda4d3a7fa8e3e1075a4385f2cc58e9638d489a742b924c92037df6.dll
Size

4KB
MD5

0fd6d0f5a63785ec9d0b6ea361d6645a
SHA1

cc25dafc9f30de8922eb5b6695ecd0f10441509f
SHA256

759db21bceda4d3a7fa8e3e1075a4385f2cc58e9638d489a742b924c92037df6
SHA512

cf3556c3c5447c96dac9185cf43f64b51cdc55b19102dde89243ae8a055be4d1b0956659cd3243069fc2b5ef10171b8f315c702d24a8560c42ac73ba35bcfe42

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1208	1752	rundll32.exe	28
PID 1752 wrote to memory of 1208	1752	rundll32.exe	28
PID 1752 wrote to memory of 1208	1752	rundll32.exe	28
PID 1752 wrote to memory of 1208	1752	rundll32.exe	28
PID 1752 wrote to memory of 1208	1752	rundll32.exe	28
PID 1752 wrote to memory of 1208	1752	rundll32.exe	28
PID 1752 wrote to memory of 1208	1752	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\759db21bceda4d3a7fa8e3e1075a4385f2cc58e9638d489a742b924c92037df6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\759db21bceda4d3a7fa8e3e1075a4385f2cc58e9638d489a742b924c92037df6.dll,#1
  2⤵
  PID:1208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-55-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download