d22e94da6ab672efd5793ed4265cadebb3be679fc300f4f2ff2a709cffbe61d8 | Triage

Analysis

max time kernel
43s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 21:43

Sharing

Report Analysis Logs

General

Target

d22e94da6ab672efd5793ed4265cadebb3be679fc300f4f2ff2a709cffbe61d8.dll
Size

3KB
MD5

f7219dba9f47761fcf3bdc740e72b35a
SHA1

64c424d43caf9d0189ab3f5ca41a16455fff1b15
SHA256

d22e94da6ab672efd5793ed4265cadebb3be679fc300f4f2ff2a709cffbe61d8
SHA512

f2d84353ccc176b2a7cf0d76eb00d399ed42051cfafbe505fdc7b9e8645a3523b530b8a953dea380044d760d2f6087d1bdb5b599732fcee195dffb5e9a90df28

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d22e94da6ab672efd5793ed4265cadebb3be679fc300f4f2ff2a709cffbe61d8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d22e94da6ab672efd5793ed4265cadebb3be679fc300f4f2ff2a709cffbe61d8.dll,#1
  2⤵
  PID:1744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1744-55-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download