21741968f4ea681e9ff1e961c85db5e971a5b691d1280c80c20c5a0c5acc5549 | Triage

Analysis

max time kernel
11s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 15:12

Sharing

Report Analysis Logs

General

Target

21741968f4ea681e9ff1e961c85db5e971a5b691d1280c80c20c5a0c5acc5549.dll
Size

3KB
MD5

16f30c08ea3fff793e6467f3997616b0
SHA1

9bb1946f59ccb503d1a0951b3dfb51246375a8d6
SHA256

21741968f4ea681e9ff1e961c85db5e971a5b691d1280c80c20c5a0c5acc5549
SHA512

172290383a3256bc2d4cb534cd37ae54a3f29feadd30296d133e19a5b00d9e0c0683e546b36f83f4cabfc271fd56e285a7d3b54156e89845951af0225acf041b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 1224	1120	rundll32.exe	28
PID 1120 wrote to memory of 1224	1120	rundll32.exe	28
PID 1120 wrote to memory of 1224	1120	rundll32.exe	28
PID 1120 wrote to memory of 1224	1120	rundll32.exe	28
PID 1120 wrote to memory of 1224	1120	rundll32.exe	28
PID 1120 wrote to memory of 1224	1120	rundll32.exe	28
PID 1120 wrote to memory of 1224	1120	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21741968f4ea681e9ff1e961c85db5e971a5b691d1280c80c20c5a0c5acc5549.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\21741968f4ea681e9ff1e961c85db5e971a5b691d1280c80c20c5a0c5acc5549.dll,#1
  2⤵
  PID:1224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1224-55-0x0000000075291000-0x0000000075293000-memory.dmp

Filesize
8KB

Download