d59101e779a5fc0c6d689b5e25614a524146233d557a0bbca172c9f425c0ad43 | Triage

Analysis

max time kernel
40s
max time network
36s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 00:40

Sharing

Report Analysis Logs

General

Target

d59101e779a5fc0c6d689b5e25614a524146233d557a0bbca172c9f425c0ad43.dll
Size

3KB
MD5

165ccf1973bd051072c4e32ac2bfefeb
SHA1

db38dd889db0164aa072d289a4c0468941dc5af4
SHA256

d59101e779a5fc0c6d689b5e25614a524146233d557a0bbca172c9f425c0ad43
SHA512

5d518274b34866bed5b406007c70b2814ac65be1c2c65312e71886617378729850240d5a5a819ebf8197b2e68cad1255a45bf0b8df1d8a7d80fd6c80a3f93521

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 828 wrote to memory of 768	828	rundll32.exe	rundll32.exe
PID 828 wrote to memory of 768	828	rundll32.exe	rundll32.exe
PID 828 wrote to memory of 768	828	rundll32.exe	rundll32.exe
PID 828 wrote to memory of 768	828	rundll32.exe	rundll32.exe
PID 828 wrote to memory of 768	828	rundll32.exe	rundll32.exe
PID 828 wrote to memory of 768	828	rundll32.exe	rundll32.exe
PID 828 wrote to memory of 768	828	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d59101e779a5fc0c6d689b5e25614a524146233d557a0bbca172c9f425c0ad43.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:828

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d59101e779a5fc0c6d689b5e25614a524146233d557a0bbca172c9f425c0ad43.dll,#1
2⤵
PID:768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/768-54-0x0000000000000000-mapping.dmp

Download
memory/768-55-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download