02d8d26f21eff50f6ab2cbde4498478e7b328cf6b6b7e087c33d059dfa7f4b4e | Triage

Analysis

max time kernel
24s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 05:14

Sharing

Report Analysis Logs

General

Target

02d8d26f21eff50f6ab2cbde4498478e7b328cf6b6b7e087c33d059dfa7f4b4e.dll
Size

3KB
MD5

75e41a60925c900f3f3ab072a2971090
SHA1

834f0b244aac31d4a20eb0833677fabf99cbf65d
SHA256

02d8d26f21eff50f6ab2cbde4498478e7b328cf6b6b7e087c33d059dfa7f4b4e
SHA512

9005bc132cd075340b7bbc29e684c146db755bc817c45ec13b91466f1f48d72dab916cf5f5384dad1ec554be1963924e358a0aa396f56357b6439641208c826e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 1436	1284	rundll32.exe	28
PID 1284 wrote to memory of 1436	1284	rundll32.exe	28
PID 1284 wrote to memory of 1436	1284	rundll32.exe	28
PID 1284 wrote to memory of 1436	1284	rundll32.exe	28
PID 1284 wrote to memory of 1436	1284	rundll32.exe	28
PID 1284 wrote to memory of 1436	1284	rundll32.exe	28
PID 1284 wrote to memory of 1436	1284	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\02d8d26f21eff50f6ab2cbde4498478e7b328cf6b6b7e087c33d059dfa7f4b4e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\02d8d26f21eff50f6ab2cbde4498478e7b328cf6b6b7e087c33d059dfa7f4b4e.dll,#1
  2⤵
  PID:1436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1436-55-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download