8f3b18d82f2673e87dc09a63653c2aa58f58119c9d4b1775f9a7e249ab04f485 | Triage

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 05:45

Sharing

Report Analysis Logs

General

Target

8f3b18d82f2673e87dc09a63653c2aa58f58119c9d4b1775f9a7e249ab04f485.dll
Size

4KB
MD5

cf89002e4aa05e5fa4a592efcfe43b70
SHA1

1687d4c4d38df29d4ca0793665197528fbdb9b19
SHA256

8f3b18d82f2673e87dc09a63653c2aa58f58119c9d4b1775f9a7e249ab04f485
SHA512

2705c4ea8391a8d0024dcf7836753525ed198e05cd50ba19fc657265856d264bda7da528371a672031996d6276913e6f6334b53d117c631612e42eee50799432

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 1732	1436	rundll32.exe	27
PID 1436 wrote to memory of 1732	1436	rundll32.exe	27
PID 1436 wrote to memory of 1732	1436	rundll32.exe	27
PID 1436 wrote to memory of 1732	1436	rundll32.exe	27
PID 1436 wrote to memory of 1732	1436	rundll32.exe	27
PID 1436 wrote to memory of 1732	1436	rundll32.exe	27
PID 1436 wrote to memory of 1732	1436	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f3b18d82f2673e87dc09a63653c2aa58f58119c9d4b1775f9a7e249ab04f485.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f3b18d82f2673e87dc09a63653c2aa58f58119c9d4b1775f9a7e249ab04f485.dll,#1
  2⤵
  PID:1732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1732-55-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download