1c388a8bd8a2f14fb270c3bcd6ef475f7536f1dd6412f0e91746c054d15db58d | Triage

Analysis

max time kernel
61s
max time network
215s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 21:55

Sharing

Report Analysis Logs

General

Target

Ծע/UUWiseHelper.dll
Size

146KB
MD5

c09c3e121ce7ef05ead3681f216a4550
SHA1

af676d70899982c4227bcc1f656e83095ea1f386
SHA256

63e9a59a04299836cec0ff7caadabbb1bc1aa50cdc66e0b71bb2aa58a1e9ccfe
SHA512

d65800f274c8fa47bf3d3d991083b3d6e37b4c5e4415bc2bc8efb29336a4066bc99dc6c10c2d26e966de37197cf5d31869e05fe5f0439a550e3d9ef39586596c
SSDEEP

3072:wQLAnZ8mWGDInSLqDZPkIusTUoEFGfQT7W5jD:3LAZ8XzS+DZPZEFGfr

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1240	1756	rundll32.exe	27
PID 1756 wrote to memory of 1240	1756	rundll32.exe	27
PID 1756 wrote to memory of 1240	1756	rundll32.exe	27
PID 1756 wrote to memory of 1240	1756	rundll32.exe	27
PID 1756 wrote to memory of 1240	1756	rundll32.exe	27
PID 1756 wrote to memory of 1240	1756	rundll32.exe	27
PID 1756 wrote to memory of 1240	1756	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ծע\UUWiseHelper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ծע\UUWiseHelper.dll,#1
  2⤵
  PID:1240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1240-55-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download