02a90f345b8c44515c355a81c671af18105bff4fd90655049de2254e7f7ab4ea | Triage

Analysis

max time kernel
35s
max time network
39s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 14:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

02a90f345b8c44515c355a81c671af18105bff4fd90655049de2254e7f7ab4ea.dll
Size

3KB
MD5

18e902963e880074a3c2aa25919fa880
SHA1

510b2cd86adab6b2e3315d70c03bd5a6f2851a9b
SHA256

02a90f345b8c44515c355a81c671af18105bff4fd90655049de2254e7f7ab4ea
SHA512

2ceec44694709d26a98543d4e481be588263692af9d2d62dcf7334dd47fef66e58ca3b4a6246c67d83cfb365769007de0365c29cb62a5cb608af5552f04960f7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1260	1488	rundll32.exe	27
PID 1488 wrote to memory of 1260	1488	rundll32.exe	27
PID 1488 wrote to memory of 1260	1488	rundll32.exe	27
PID 1488 wrote to memory of 1260	1488	rundll32.exe	27
PID 1488 wrote to memory of 1260	1488	rundll32.exe	27
PID 1488 wrote to memory of 1260	1488	rundll32.exe	27
PID 1488 wrote to memory of 1260	1488	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\02a90f345b8c44515c355a81c671af18105bff4fd90655049de2254e7f7ab4ea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\02a90f345b8c44515c355a81c671af18105bff4fd90655049de2254e7f7ab4ea.dll,#1
  2⤵
  PID:1260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1260-55-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download