43d1bf9aa0edcf55ba1299dc2386860302f322c196e597af1aeae4381c8d502f | Triage

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:40

Sharing

Report Analysis Logs

General

Target

43d1bf9aa0edcf55ba1299dc2386860302f322c196e597af1aeae4381c8d502f.dll
Size

3KB
MD5

17330a48f6a15d0e2575c6547a4c8ac5
SHA1

8d8d93ab69bb089e3291a3e37e63a15b3062c375
SHA256

43d1bf9aa0edcf55ba1299dc2386860302f322c196e597af1aeae4381c8d502f
SHA512

f624c47696458cea71dcdaa0ea203b5ce6673dbafd9f382541557d66a491917cbb0a3ae2bdf8a2f4913fda21c140e91119551f5f03f88b956ed0b987b2bf2c8e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\43d1bf9aa0edcf55ba1299dc2386860302f322c196e597af1aeae4381c8d502f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\43d1bf9aa0edcf55ba1299dc2386860302f322c196e597af1aeae4381c8d502f.dll,#1
2⤵
PID:944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/944-54-0x0000000000000000-mapping.dmp

Download
memory/944-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download