4590932ab6a7971447a7f646e9d41c45287744a39928b2eaa106defd5bad6ca0 | Triage

Analysis

max time kernel
3s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 00:41

Sharing

Report Analysis Logs

General

Target

4590932ab6a7971447a7f646e9d41c45287744a39928b2eaa106defd5bad6ca0.dll
Size

3KB
MD5

06cdced73cbbfbf06512c0cb7db286dd
SHA1

b400bc8d9c6c27b2fcecc53b6ac8bd8ac2e7b4e2
SHA256

4590932ab6a7971447a7f646e9d41c45287744a39928b2eaa106defd5bad6ca0
SHA512

cd9ed3dfd3aadfbd83c2bae2b8a5e68f69bc92f8c9e0085e7863fa74c067bc29848b6444d0f73251a30357746befda3807730680f1adbd9c10f18f9aeac1a465

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1788 wrote to memory of 2040	1788	rundll32.exe	rundll32.exe
PID 1788 wrote to memory of 2040	1788	rundll32.exe	rundll32.exe
PID 1788 wrote to memory of 2040	1788	rundll32.exe	rundll32.exe
PID 1788 wrote to memory of 2040	1788	rundll32.exe	rundll32.exe
PID 1788 wrote to memory of 2040	1788	rundll32.exe	rundll32.exe
PID 1788 wrote to memory of 2040	1788	rundll32.exe	rundll32.exe
PID 1788 wrote to memory of 2040	1788	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4590932ab6a7971447a7f646e9d41c45287744a39928b2eaa106defd5bad6ca0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4590932ab6a7971447a7f646e9d41c45287744a39928b2eaa106defd5bad6ca0.dll,#1
2⤵
PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-54-0x0000000000000000-mapping.dmp

Download
memory/2040-55-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download