05394391853b02247147639fda1d0bf9b5f3291dc70a490d6afbccfb3dc6f534 | Triage

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 06:56

Sharing

Report Analysis Logs

General

Target

05394391853b02247147639fda1d0bf9b5f3291dc70a490d6afbccfb3dc6f534.dll
Size

4KB
MD5

faa03be3aba25765234b25f362249a20
SHA1

b8dfe84ce7fcdc98c31227522744fcdb8773a07b
SHA256

05394391853b02247147639fda1d0bf9b5f3291dc70a490d6afbccfb3dc6f534
SHA512

2c36793af695f1fb5786dada2f2cada9981676c9f63ecf4d8d6b6ad09340d9205da9363be3955fd3c8401b40106ac68a5fb28e25b601c4ec5b8792afa0293c6f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05394391853b02247147639fda1d0bf9b5f3291dc70a490d6afbccfb3dc6f534.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05394391853b02247147639fda1d0bf9b5f3291dc70a490d6afbccfb3dc6f534.dll,#1
  2⤵
  PID:788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/788-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download