12c09ace23ca076a4ee7beb3e7088e7e6ab83b3900d55e6b416e3bf6a91d9ef6 | Triage

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:58

Sharing

Report Analysis Logs

General

Target

12c09ace23ca076a4ee7beb3e7088e7e6ab83b3900d55e6b416e3bf6a91d9ef6.dll
Size

3KB
MD5

51b19adba7f496971c6c4702d7730643
SHA1

366e55d302f287dd34b17fd42471894ec5cc6a3b
SHA256

12c09ace23ca076a4ee7beb3e7088e7e6ab83b3900d55e6b416e3bf6a91d9ef6
SHA512

934918dd686c785e3cd092eb766362dfd9b36f80c6fb5ac179b53c022c4e086d85186f88165a9175557581ed8a7d636e4b9c6a1e863a541d288dce9d6b737a5a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1112 wrote to memory of 1472	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 1472	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 1472	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 1472	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 1472	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 1472	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 1472	1112	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12c09ace23ca076a4ee7beb3e7088e7e6ab83b3900d55e6b416e3bf6a91d9ef6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\12c09ace23ca076a4ee7beb3e7088e7e6ab83b3900d55e6b416e3bf6a91d9ef6.dll,#1
  2⤵
  PID:1472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1472-54-0x0000000000000000-mapping.dmp

Download
memory/1472-55-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download