120550fcc0d7eaf24bfdac08615b1bdad4d79ea0fd2bc0dac7048d0beb3b3a7d | Triage

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 17:26

Sharing

Report Analysis Logs

General

Target

Interop.ADODB.dll
Size

100KB
MD5

cd3a6224a31d0990694377d72ddffcf8
SHA1

4f8c9aaaffbe3fb862acc7be9918949e4941df50
SHA256

4a17ba10cee159d82b521046f49a5cc9c9ee1da668ae028fbf281861b292b991
SHA512

2e086559c41b25bd508f38d11d6485af45f14854655bb64e5bf9d69f544d4a9d4c6d92cfb10323f452724638cf703b5378fa6a08fe3ebe009dec2f7e72334441
SSDEEP

3072:czZAHCp0zu6IGlyPMJuDINT35+DNqOtS5z5j3KHrgMEi8:ctAHCp0zu6IGlyPMJuDItpENb8KLgd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1768 wrote to memory of 1112	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1112	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1112	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1112	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1112	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1112	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1112	1768	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Interop.ADODB.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Interop.ADODB.dll,#1
  2⤵
  PID:1112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1112-54-0x0000000000000000-mapping.dmp

Download
memory/1112-55-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download