d14b6d2355c289076aafa97b5886e94d5e9198ca3dfca0df5a30e08db367d9cd | Triage

Analysis

max time kernel
11s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 15:06

Sharing

Report Analysis Logs

General

Target

d14b6d2355c289076aafa97b5886e94d5e9198ca3dfca0df5a30e08db367d9cd.dll
Size

3KB
MD5

e51ae4326228f8820210f6e5530a2f10
SHA1

4492bb683935871215b503368a94062d2cae928a
SHA256

d14b6d2355c289076aafa97b5886e94d5e9198ca3dfca0df5a30e08db367d9cd
SHA512

bd9c4268cca17bf4a5f4a702d73b38647c2064d1dd7bfc5c3cee81f19b9433c19083f2b2dfb4b27126769eed7b71d5c40c1ea055f8831ac4c443f7c92efc51a6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1724	1636	rundll32.exe	28
PID 1636 wrote to memory of 1724	1636	rundll32.exe	28
PID 1636 wrote to memory of 1724	1636	rundll32.exe	28
PID 1636 wrote to memory of 1724	1636	rundll32.exe	28
PID 1636 wrote to memory of 1724	1636	rundll32.exe	28
PID 1636 wrote to memory of 1724	1636	rundll32.exe	28
PID 1636 wrote to memory of 1724	1636	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d14b6d2355c289076aafa97b5886e94d5e9198ca3dfca0df5a30e08db367d9cd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d14b6d2355c289076aafa97b5886e94d5e9198ca3dfca0df5a30e08db367d9cd.dll,#1
  2⤵
  PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-55-0x00000000757B1000-0x00000000757B3000-memory.dmp

Filesize
8KB

Download