edb9c0f515ce5952e438ceb51aaecf73000ef9a3a3bfb05c96339efda506ad3f | Triage

Analysis

max time kernel
34s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 15:05

Sharing

Report Analysis Logs

General

Target

edb9c0f515ce5952e438ceb51aaecf73000ef9a3a3bfb05c96339efda506ad3f.dll
Size

3KB
MD5

c6b95dee8f3d3d51c19cf62d9d6d7ee9
SHA1

a1edc987a7b3fb5b0d150716e56961298905c475
SHA256

edb9c0f515ce5952e438ceb51aaecf73000ef9a3a3bfb05c96339efda506ad3f
SHA512

f030319c9be071339a294c5869a48b8200715e8eabc62bdab37d1b88471313d719c7d583062fd413789afe272854570da51f9ee4b4b8d56a80f0e358ce4049d9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1284	1972	rundll32.exe	28
PID 1972 wrote to memory of 1284	1972	rundll32.exe	28
PID 1972 wrote to memory of 1284	1972	rundll32.exe	28
PID 1972 wrote to memory of 1284	1972	rundll32.exe	28
PID 1972 wrote to memory of 1284	1972	rundll32.exe	28
PID 1972 wrote to memory of 1284	1972	rundll32.exe	28
PID 1972 wrote to memory of 1284	1972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\edb9c0f515ce5952e438ceb51aaecf73000ef9a3a3bfb05c96339efda506ad3f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\edb9c0f515ce5952e438ceb51aaecf73000ef9a3a3bfb05c96339efda506ad3f.dll,#1
  2⤵
  PID:1284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1284-54-0x0000000000000000-mapping.dmp

Download
memory/1284-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download