fc896f904cb5577a177895f5fe1b1c882294d8922135f8786eac1f06be7e0f4e | Triage

Analysis

max time kernel
21s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 00:40

Sharing

Report Analysis Logs

General

Target

fc896f904cb5577a177895f5fe1b1c882294d8922135f8786eac1f06be7e0f4e.dll
Size

3KB
MD5

2a89da5b351a9f4462a1dc3724790110
SHA1

8923e66e179bad0e753e9c503184ca729488f373
SHA256

fc896f904cb5577a177895f5fe1b1c882294d8922135f8786eac1f06be7e0f4e
SHA512

b5d49b3554f752920503c2f90aadc8cb3cf62e9662d006feeef7959e13afd118a76d50d5221196599d2ff23f00706754c579c3c208a26681d57bedb6920662b5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 1732	884	rundll32.exe	28
PID 884 wrote to memory of 1732	884	rundll32.exe	28
PID 884 wrote to memory of 1732	884	rundll32.exe	28
PID 884 wrote to memory of 1732	884	rundll32.exe	28
PID 884 wrote to memory of 1732	884	rundll32.exe	28
PID 884 wrote to memory of 1732	884	rundll32.exe	28
PID 884 wrote to memory of 1732	884	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc896f904cb5577a177895f5fe1b1c882294d8922135f8786eac1f06be7e0f4e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc896f904cb5577a177895f5fe1b1c882294d8922135f8786eac1f06be7e0f4e.dll,#1
  2⤵
  PID:1732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1732-54-0x0000000000000000-mapping.dmp

Download
memory/1732-55-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download