7b59997f4efdf54a64dbbcb60c98d02dde50772b39552f9c7bd9c2fa809887b3 | Triage

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 05:50

Sharing

Report Analysis Logs

General

Target

krnln.dll
Size

1.2MB
MD5

81c22cc42c6bcda834ecbc5eadaa35fd
SHA1

18d75f87b15497e786e34656721057a66bf3e834
SHA256

3e6241fc94443e8e2c6b2ec2298be385786079f0c8c3503c72b827796233e585
SHA512

4fe7dd4713fad03ac6583bc12c188b529334b596ac9eb61dccf5c8cdcbbefc758fb119cf730f1eb1fccd23c6a251ec0c1714d074434b75c23fcd828610df373a
SSDEEP

24576:zbFW06TIbzm62/OzW10uqxqjfHgDMJtZSUJvJIqlM4B5:Xs96xz1xqbHjzp5B5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 1764	1336	rundll32.exe	28
PID 1336 wrote to memory of 1764	1336	rundll32.exe	28
PID 1336 wrote to memory of 1764	1336	rundll32.exe	28
PID 1336 wrote to memory of 1764	1336	rundll32.exe	28
PID 1336 wrote to memory of 1764	1336	rundll32.exe	28
PID 1336 wrote to memory of 1764	1336	rundll32.exe	28
PID 1336 wrote to memory of 1764	1336	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\krnln.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\krnln.dll,#1
  2⤵
  PID:1764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1764-55-0x0000000075E81000-0x0000000075E83000-memory.dmp

Filesize
8KB

Download