8a5910d0d8b129e75d7ec2e5f209b64b3b663f476a12b34c5318135c893219eb | Triage

Analysis

max time kernel
247s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 05:45

Sharing

Report Analysis Logs

General

Target

8a5910d0d8b129e75d7ec2e5f209b64b3b663f476a12b34c5318135c893219eb.dll
Size

4KB
MD5

4fd4848c6020fc17dee3ce0f2eb02e10
SHA1

5b7e290b1c710f67f8b3bde6843c943d2b995caa
SHA256

8a5910d0d8b129e75d7ec2e5f209b64b3b663f476a12b34c5318135c893219eb
SHA512

f859ff1765bbb6b77f929e2f6f8d0ccce3379feeb8f453c266d73bb26964ce8149d05c2891390c2df6b5953515fd7f172b6c7939d5ea3d7a014448aa68282296

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 556	520	rundll32.exe	28
PID 520 wrote to memory of 556	520	rundll32.exe	28
PID 520 wrote to memory of 556	520	rundll32.exe	28
PID 520 wrote to memory of 556	520	rundll32.exe	28
PID 520 wrote to memory of 556	520	rundll32.exe	28
PID 520 wrote to memory of 556	520	rundll32.exe	28
PID 520 wrote to memory of 556	520	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a5910d0d8b129e75d7ec2e5f209b64b3b663f476a12b34c5318135c893219eb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a5910d0d8b129e75d7ec2e5f209b64b3b663f476a12b34c5318135c893219eb.dll,#1
  2⤵
  PID:556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/556-55-0x0000000074ED1000-0x0000000074ED3000-memory.dmp

Filesize
8KB

Download