7b59997f4efdf54a64dbbcb60c98d02dde50772b39552f9c7bd9c2fa809887b3 | Triage

Analysis

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 05:50

Sharing

Report Analysis Logs

General

Target

const.dll
Size

952KB
MD5

1718e9013e5d5a4d0e6b4890be957e37
SHA1

d3684d849d96e4b1712206f07d737a1cee94716b
SHA256

6d00e79b70e57209ae623f59480e3255d87a60858da87dcc751cd3018796f759
SHA512

6b1b2a538346bc73c30f24eb06ad217b1bbb80e880551e6107e7a0e286321e32823e3a4b6c12d1a8e34b416324247fbb5f93b54fb4f838f13f3174072e636e71
SSDEEP

12288:Cqh/i7xvXMrYsah466BEqAoketLGQQA51ictk4m:CqVCsaJOAiGQr1ica4m

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1868	364	rundll32.exe	28
PID 364 wrote to memory of 1868	364	rundll32.exe	28
PID 364 wrote to memory of 1868	364	rundll32.exe	28
PID 364 wrote to memory of 1868	364	rundll32.exe	28
PID 364 wrote to memory of 1868	364	rundll32.exe	28
PID 364 wrote to memory of 1868	364	rundll32.exe	28
PID 364 wrote to memory of 1868	364	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\const.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\const.dll,#1
  2⤵
  PID:1868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1868-55-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download