7b59997f4efdf54a64dbbcb60c98d02dde50772b39552f9c7bd9c2fa809887b3 | Triage

Analysis

max time kernel
26s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 05:50

Sharing

Report Analysis Logs

General

Target

script.dll
Size

164KB
MD5

f8a655e81afbd29bffb1529eb81c0bce
SHA1

7b1f082a1f8af3921536703ee4372374d28b6f05
SHA256

775f7b81401b9ee7b0a4f34809ba55c6bf816b21471c1c0797a386707da068ad
SHA512

537006acb144ada6f9499b08b42fa9e7d49c5ed040a8b1bc82742cb64efed7fed0f743f768cfbf382e9cefcc59d9b0f5e66198ddcb97d4c710ba36aa15a33a67
SSDEEP

3072:CPb/Y2so9Mmaf8XKcHs4Wzuo2kOpSznaF4z:u/IjxfApkz

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 1264	1232	rundll32.exe	28
PID 1232 wrote to memory of 1264	1232	rundll32.exe	28
PID 1232 wrote to memory of 1264	1232	rundll32.exe	28
PID 1232 wrote to memory of 1264	1232	rundll32.exe	28
PID 1232 wrote to memory of 1264	1232	rundll32.exe	28
PID 1232 wrote to memory of 1264	1232	rundll32.exe	28
PID 1232 wrote to memory of 1264	1232	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\script.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\script.dll,#1
  2⤵
  PID:1264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1264-55-0x0000000075291000-0x0000000075293000-memory.dmp

Filesize
8KB

Download