1f325101d135587fe78c121b2e65537638ba81a7f099665a33bc58a1c74af1a2 | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 13:22

Sharing

Report Analysis Logs

General

Target

1f325101d135587fe78c121b2e65537638ba81a7f099665a33bc58a1c74af1a2.dll
Size

4KB
MD5

eeb36820a72b1db2b8856444d8d5b86b
SHA1

7bcbf4adae3e79beafe3ea43a4e94df360425e08
SHA256

1f325101d135587fe78c121b2e65537638ba81a7f099665a33bc58a1c74af1a2
SHA512

a8694113d7afc125bb716b28a43a7afd98a1333af28815b97111711c684153606b733f66e18e752beae2670dc9f6c6bc982e2075e15151a82944219e60b62230

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1832	1960	rundll32.exe	28
PID 1960 wrote to memory of 1832	1960	rundll32.exe	28
PID 1960 wrote to memory of 1832	1960	rundll32.exe	28
PID 1960 wrote to memory of 1832	1960	rundll32.exe	28
PID 1960 wrote to memory of 1832	1960	rundll32.exe	28
PID 1960 wrote to memory of 1832	1960	rundll32.exe	28
PID 1960 wrote to memory of 1832	1960	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f325101d135587fe78c121b2e65537638ba81a7f099665a33bc58a1c74af1a2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f325101d135587fe78c121b2e65537638ba81a7f099665a33bc58a1c74af1a2.dll,#1
  2⤵
  PID:1832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1832-55-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download