9790452393c8854dc8da507d5941c1d6576ca56070431abfa4888f91ed2071db | Triage

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23/11/2022, 18:06

Sharing

Report Analysis Logs

General

Target

9790452393c8854dc8da507d5941c1d6576ca56070431abfa4888f91ed2071db.dll
Size

3KB
MD5

070212cddd7ca38649de5d6803b1487d
SHA1

d740ed9300d5754de7b44ebeabca84d4373341ea
SHA256

9790452393c8854dc8da507d5941c1d6576ca56070431abfa4888f91ed2071db
SHA512

a65428548feada9c7bfda3a19332d6e450742423187c45dfbe069e01dc889f1d7e54884e1fbf91381d52da85167fa4b9a95b5e4e23b5404f54fc18ed5f88166a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 336	2032	rundll32.exe	28
PID 2032 wrote to memory of 336	2032	rundll32.exe	28
PID 2032 wrote to memory of 336	2032	rundll32.exe	28
PID 2032 wrote to memory of 336	2032	rundll32.exe	28
PID 2032 wrote to memory of 336	2032	rundll32.exe	28
PID 2032 wrote to memory of 336	2032	rundll32.exe	28
PID 2032 wrote to memory of 336	2032	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9790452393c8854dc8da507d5941c1d6576ca56070431abfa4888f91ed2071db.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9790452393c8854dc8da507d5941c1d6576ca56070431abfa4888f91ed2071db.dll,#1
  2⤵
  PID:336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/336-55-0x0000000076B51000-0x0000000076B53000-memory.dmp

Filesize
8KB

Download