84e7bdf1940ac00b63297f9d9cee613e32961fb5bfc00e08169552a1f9fb79e2 | Triage

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 05:57

Sharing

Report Analysis Logs

General

Target

84e7bdf1940ac00b63297f9d9cee613e32961fb5bfc00e08169552a1f9fb79e2.dll
Size

3KB
MD5

78c0a79ec58d84d4ebaab2fae5218380
SHA1

765fb08d8ccb71bbed11cf06420836bce0c02750
SHA256

84e7bdf1940ac00b63297f9d9cee613e32961fb5bfc00e08169552a1f9fb79e2
SHA512

ecd8cc0c1d4a9b78a07db7fd8060155fd1ccb5a52e357d171f8875300e434e49cc6db2db1e2e274bee295ccc497fe4238920ca94d620f1d363f1cf97d7fdadae

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 956	996	rundll32.exe	27
PID 996 wrote to memory of 956	996	rundll32.exe	27
PID 996 wrote to memory of 956	996	rundll32.exe	27
PID 996 wrote to memory of 956	996	rundll32.exe	27
PID 996 wrote to memory of 956	996	rundll32.exe	27
PID 996 wrote to memory of 956	996	rundll32.exe	27
PID 996 wrote to memory of 956	996	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\84e7bdf1940ac00b63297f9d9cee613e32961fb5bfc00e08169552a1f9fb79e2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\84e7bdf1940ac00b63297f9d9cee613e32961fb5bfc00e08169552a1f9fb79e2.dll,#1
  2⤵
  PID:956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-55-0x00000000760E1000-0x00000000760E3000-memory.dmp

Filesize
8KB

Download