cbc5b7a85599f42832732c6a87c04138643914fd9980d5406d3739d22b83859a | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 15:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cbc5b7a85599f42832732c6a87c04138643914fd9980d5406d3739d22b83859a.dll
Size

3KB
MD5

f213104ce6e0638695fb597336a00fe0
SHA1

aaa43fb20495fea9cd9d04da3adf7cd58aefe9a2
SHA256

cbc5b7a85599f42832732c6a87c04138643914fd9980d5406d3739d22b83859a
SHA512

8d661eab1cc2bd1ca7df991000369e4c0e98da7fc3305894516b7e8cbc0e3d12ee703694e1c7bfb9fb43d623f2094929061a23fec9dc14e633062d9e3966396f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 892	2028	rundll32.exe	28
PID 2028 wrote to memory of 892	2028	rundll32.exe	28
PID 2028 wrote to memory of 892	2028	rundll32.exe	28
PID 2028 wrote to memory of 892	2028	rundll32.exe	28
PID 2028 wrote to memory of 892	2028	rundll32.exe	28
PID 2028 wrote to memory of 892	2028	rundll32.exe	28
PID 2028 wrote to memory of 892	2028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbc5b7a85599f42832732c6a87c04138643914fd9980d5406d3739d22b83859a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbc5b7a85599f42832732c6a87c04138643914fd9980d5406d3739d22b83859a.dll,#1
  2⤵
  PID:892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/892-55-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download