a9a0de13bbdf1c95ba87a6ec5cecdb36a8bc5089d89223e28ed9d8ba7b3c7de6 | Triage

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 03:37

Sharing

Report Analysis Logs

General

Target

a9a0de13bbdf1c95ba87a6ec5cecdb36a8bc5089d89223e28ed9d8ba7b3c7de6.dll
Size

4KB
MD5

e9f1eb50bca313d475abe35d1db1d090
SHA1

655dabdcedc35123867046d4479aa5a3c06a4c52
SHA256

a9a0de13bbdf1c95ba87a6ec5cecdb36a8bc5089d89223e28ed9d8ba7b3c7de6
SHA512

e35fb4b110df7812e2315a576ef19de0a4746627cc35ad646af8a938107d7d90e692c6ae8820612374bb746671ba0cba820dba5fe21861cd64ff5e19df4b33ee

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27
PID 1132 wrote to memory of 1172	1132	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9a0de13bbdf1c95ba87a6ec5cecdb36a8bc5089d89223e28ed9d8ba7b3c7de6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9a0de13bbdf1c95ba87a6ec5cecdb36a8bc5089d89223e28ed9d8ba7b3c7de6.dll,#1
  2⤵
  PID:1172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1172-55-0x0000000075561000-0x0000000075563000-memory.dmp

Filesize
8KB

Download