de981ba7b91ac39e6902c39427f67083be389362e3204f25aa72347fcb230787 | Triage

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 00:40

Sharing

Report Analysis Logs

General

Target

de981ba7b91ac39e6902c39427f67083be389362e3204f25aa72347fcb230787.dll
Size

3KB
MD5

3511b2eb2e5419dfe70fcac9ddefdd40
SHA1

09e3826fc6916bfeba73f3dec2b1cf2da28cb86e
SHA256

de981ba7b91ac39e6902c39427f67083be389362e3204f25aa72347fcb230787
SHA512

fa3cfc4e0e40be8201f541f4bd484415a7cd9af8d6928e80755282ba7019636097b803b30c26aee1b67f4de527b6e061fa484a1c6f1bcfa07df17e717a1227a6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1560	1344	rundll32.exe	26
PID 1344 wrote to memory of 1560	1344	rundll32.exe	26
PID 1344 wrote to memory of 1560	1344	rundll32.exe	26
PID 1344 wrote to memory of 1560	1344	rundll32.exe	26
PID 1344 wrote to memory of 1560	1344	rundll32.exe	26
PID 1344 wrote to memory of 1560	1344	rundll32.exe	26
PID 1344 wrote to memory of 1560	1344	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de981ba7b91ac39e6902c39427f67083be389362e3204f25aa72347fcb230787.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de981ba7b91ac39e6902c39427f67083be389362e3204f25aa72347fcb230787.dll,#1
  2⤵
  PID:1560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1560-55-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download