325c5bc02bfc1911d6e1cdc0e559d52f2bebd934ec5a33b7342a2aef549fb64f | Triage

Analysis

max time kernel
30s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 15:11

Sharing

Report Analysis Logs

General

Target

325c5bc02bfc1911d6e1cdc0e559d52f2bebd934ec5a33b7342a2aef549fb64f.dll
Size

3KB
MD5

80ce3bb26a9c8b0a0f2096d5dcb48360
SHA1

12f3b320686a7648e6553816aaa4dc7b1cfc228e
SHA256

325c5bc02bfc1911d6e1cdc0e559d52f2bebd934ec5a33b7342a2aef549fb64f
SHA512

8a0f87a26b5d2aeb2a8f3949d1a7f72d5934dafbaf5e378b7861678c72b5eaf2ef5079245d27160290d01d7a76810abcfaf4e9599c5fd0ec2440bdaa8b799619

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1888	1160	rundll32.exe	28
PID 1160 wrote to memory of 1888	1160	rundll32.exe	28
PID 1160 wrote to memory of 1888	1160	rundll32.exe	28
PID 1160 wrote to memory of 1888	1160	rundll32.exe	28
PID 1160 wrote to memory of 1888	1160	rundll32.exe	28
PID 1160 wrote to memory of 1888	1160	rundll32.exe	28
PID 1160 wrote to memory of 1888	1160	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\325c5bc02bfc1911d6e1cdc0e559d52f2bebd934ec5a33b7342a2aef549fb64f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\325c5bc02bfc1911d6e1cdc0e559d52f2bebd934ec5a33b7342a2aef549fb64f.dll,#1
  2⤵
  PID:1888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1888-55-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download