fb8c0ff5fcc749ca4963a64b9b37e2f80c8fda8fc2273b7e483e33b1939a9aad | Triage

Analysis

max time kernel
25s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 05:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fb8c0ff5fcc749ca4963a64b9b37e2f80c8fda8fc2273b7e483e33b1939a9aad.dll
Size

4KB
MD5

a18b2926770d03aac4bbdd57e300ed20
SHA1

327d3324f8487b20447ba79db7d8a1c32a2ec86e
SHA256

fb8c0ff5fcc749ca4963a64b9b37e2f80c8fda8fc2273b7e483e33b1939a9aad
SHA512

3d50f99d896fcc965eff19542edfc2bdab4be237222b03aef48c4868f932684abc7cc5daaeb24260b7b73b7576625bc449c77674242899fd065326e311fe9cbd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1984	900	rundll32.exe	27
PID 900 wrote to memory of 1984	900	rundll32.exe	27
PID 900 wrote to memory of 1984	900	rundll32.exe	27
PID 900 wrote to memory of 1984	900	rundll32.exe	27
PID 900 wrote to memory of 1984	900	rundll32.exe	27
PID 900 wrote to memory of 1984	900	rundll32.exe	27
PID 900 wrote to memory of 1984	900	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb8c0ff5fcc749ca4963a64b9b37e2f80c8fda8fc2273b7e483e33b1939a9aad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb8c0ff5fcc749ca4963a64b9b37e2f80c8fda8fc2273b7e483e33b1939a9aad.dll,#1
  2⤵
  PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1984-55-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download