7b59997f4efdf54a64dbbcb60c98d02dde50772b39552f9c7bd9c2fa809887b3 | Triage

Analysis

max time kernel
27s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 05:50

Sharing

Report Analysis Logs

General

Target

iext.dll
Size

204KB
MD5

856495a1605bfc7f62086d482b502c6f
SHA1

86ecc67a784bc69157d664850d489aab64f5f912
SHA256

8c8254cb49f7287b97c7f952c81edabc9f11f3fa3f02f265e67d5741998cf0bf
SHA512

35a6e580cd362c64f1e1f9c3439660bd980ec437bd8cabbdc49479ceb833cd8cb6c82d2fb747516d5cfcf2af0ba540bc01640171fbe3b4d0e0a3eeeaa69dd1d9
SSDEEP

3072:qOs+pOZXaFAO0shQe9lkvelFv76OD5KoUThiL5t3gIn:C+0cB+vebJ6iLTF

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 1332	1564	rundll32.exe	28
PID 1564 wrote to memory of 1332	1564	rundll32.exe	28
PID 1564 wrote to memory of 1332	1564	rundll32.exe	28
PID 1564 wrote to memory of 1332	1564	rundll32.exe	28
PID 1564 wrote to memory of 1332	1564	rundll32.exe	28
PID 1564 wrote to memory of 1332	1564	rundll32.exe	28
PID 1564 wrote to memory of 1332	1564	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\iext.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\iext.dll,#1
  2⤵
  PID:1332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1332-54-0x0000000000000000-mapping.dmp

Download
memory/1332-55-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download