cd34dec6257383ac8208a176b712a6e785bdc9259f81732d60811f5b81e4b473 | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 04:44

Sharing

Report Analysis Logs

General

Target

sock.dll
Size

60KB
MD5

698bd942f9334e0ab5d0c7002b13ed70
SHA1

58eb04593c14ccb0c3f703b35710faf05711465c
SHA256

9578922e34dfc8f3298e67dcaa5075d870dfdc4ef958985d5fc0e5e6b3849aa9
SHA512

e0c78360c55c31ec139e7a0d8b44e3702dc721c1ea66c9e5deb9fde2bd4122ba10012b67d0d614ecc665a68d9ceb0d8fc79d279f41e7390ef3fe2495901b7740
SSDEEP

768:Wo7bG/hX9OdejL8BK0BofPT/bz7IjG/OqhhItJ22uk8ao00O:C/hXIcjL8xufPT/bz5/OqMIYo0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1904 wrote to memory of 1604	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1604	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1604	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1604	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1604	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1604	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1604	1904	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sock.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sock.dll,#1
2⤵
PID:1604

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1604-54-0x0000000000000000-mapping.dmp

Download
memory/1604-55-0x0000000076DC1000-0x0000000076DC3000-memory.dmp

Filesize
8KB

Download