688efab0043159ef1ed0efe52202e5777846c59ed4d0b61192f8f7eb09bab077 | Triage

Analysis

max time kernel
37s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 05:48

Sharing

Report Analysis Logs

General

Target

688efab0043159ef1ed0efe52202e5777846c59ed4d0b61192f8f7eb09bab077.dll
Size

4KB
MD5

17989217c10a0446a44479f48fe2ce60
SHA1

4b712eb0571614ac582cd192ec9d17d76feef419
SHA256

688efab0043159ef1ed0efe52202e5777846c59ed4d0b61192f8f7eb09bab077
SHA512

d9ab4f62dc77ab805ee3671dc814cd9b31ef8ee03cf6992a4a8ebc2f49b25d6246e8edfc86283318d7e238fca2d8b6d475f1a1bc0f5e4e0edbef7c612048de39

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 832	576	rundll32.exe	26
PID 576 wrote to memory of 832	576	rundll32.exe	26
PID 576 wrote to memory of 832	576	rundll32.exe	26
PID 576 wrote to memory of 832	576	rundll32.exe	26
PID 576 wrote to memory of 832	576	rundll32.exe	26
PID 576 wrote to memory of 832	576	rundll32.exe	26
PID 576 wrote to memory of 832	576	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\688efab0043159ef1ed0efe52202e5777846c59ed4d0b61192f8f7eb09bab077.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\688efab0043159ef1ed0efe52202e5777846c59ed4d0b61192f8f7eb09bab077.dll,#1
  2⤵
  PID:832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/832-54-0x0000000000000000-mapping.dmp

Download
memory/832-55-0x0000000075911000-0x0000000075913000-memory.dmp

Filesize
8KB

Download