9b84310e71c8b8c6ef23df01cd4af359a9ed10297c9197391b8cd1ffcd20b1e2 | Triage

Analysis

max time kernel
33s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 04:45

Sharing

Report Analysis Logs

General

Target

9b84310e71c8b8c6ef23df01cd4af359a9ed10297c9197391b8cd1ffcd20b1e2.dll
Size

3KB
MD5

7a2f8fa2a47328a18d42f0f83260cc80
SHA1

eeac9fa046aba3be38ce6e340baf0229213ffbc4
SHA256

9b84310e71c8b8c6ef23df01cd4af359a9ed10297c9197391b8cd1ffcd20b1e2
SHA512

f3398dd6973fdc1dad0f0aba174b515890a78b796b778a95f4e25315b113d7c75bf5b658f51bbd9c690a34da962dad0b50a2b3ae6a113a8276a50fef4a8844f7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2024	2032	rundll32.exe	28
PID 2032 wrote to memory of 2024	2032	rundll32.exe	28
PID 2032 wrote to memory of 2024	2032	rundll32.exe	28
PID 2032 wrote to memory of 2024	2032	rundll32.exe	28
PID 2032 wrote to memory of 2024	2032	rundll32.exe	28
PID 2032 wrote to memory of 2024	2032	rundll32.exe	28
PID 2032 wrote to memory of 2024	2032	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b84310e71c8b8c6ef23df01cd4af359a9ed10297c9197391b8cd1ffcd20b1e2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b84310e71c8b8c6ef23df01cd4af359a9ed10297c9197391b8cd1ffcd20b1e2.dll,#1
  2⤵
  PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2024-54-0x0000000000000000-mapping.dmp

Download
memory/2024-55-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download