31d6867d86c4a9e755eda60140930913a7d4d482cc060d8c571e1f4013d0093b | Triage

Analysis

max time kernel
41s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 05:22

Sharing

Report Analysis Logs

General

Target

31d6867d86c4a9e755eda60140930913a7d4d482cc060d8c571e1f4013d0093b.dll
Size

3KB
MD5

c87b887c5a8236869b0e162c3c003c30
SHA1

f78e9ed3e98c94506b20acfa6cd78f0f6795cddd
SHA256

31d6867d86c4a9e755eda60140930913a7d4d482cc060d8c571e1f4013d0093b
SHA512

a0af6ff487b037ee1889a71307ccbe2a86234acae43dad9b690a858f1e3ece1b87caf32350abd65034329babc71cd6bd727fcd79ad2fc35ea2745b1f62086004

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 620	1276	rundll32.exe	27
PID 1276 wrote to memory of 620	1276	rundll32.exe	27
PID 1276 wrote to memory of 620	1276	rundll32.exe	27
PID 1276 wrote to memory of 620	1276	rundll32.exe	27
PID 1276 wrote to memory of 620	1276	rundll32.exe	27
PID 1276 wrote to memory of 620	1276	rundll32.exe	27
PID 1276 wrote to memory of 620	1276	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31d6867d86c4a9e755eda60140930913a7d4d482cc060d8c571e1f4013d0093b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31d6867d86c4a9e755eda60140930913a7d4d482cc060d8c571e1f4013d0093b.dll,#1
  2⤵
  PID:620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/620-55-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download