6f0515a35173b8fa8b03dc252911dc93011ee1a0040abadc43496c38453246c2 | Triage

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 15:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6f0515a35173b8fa8b03dc252911dc93011ee1a0040abadc43496c38453246c2.dll
Size

3KB
MD5

4e41d47d858934ab212365034e9b92c0
SHA1

68d9290c3e521b82fd0f17ed117ed562b870acdc
SHA256

6f0515a35173b8fa8b03dc252911dc93011ee1a0040abadc43496c38453246c2
SHA512

ce906980b5e2d2fb10d98c31f16d655be670865fb95cf90e9122121b3d922fa2a9de5fc44a09b9c8091c1a4090ff1514cc9082167bad138c3eca7d46e0337575

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f0515a35173b8fa8b03dc252911dc93011ee1a0040abadc43496c38453246c2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f0515a35173b8fa8b03dc252911dc93011ee1a0040abadc43496c38453246c2.dll,#1
  2⤵
  PID:1080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1080-55-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download