a49ca14194984b58074a837d69f630e7275d082022b2f2b25af8c48606995798 | Triage

Analysis

max time kernel
249s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 21:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a49ca14194984b58074a837d69f630e7275d082022b2f2b25af8c48606995798.dll
Size

3KB
MD5

ef4637f713a73f015dddeb3cb680cd24
SHA1

abd7732d4493030d3a001820ecc0263cab87e8ff
SHA256

a49ca14194984b58074a837d69f630e7275d082022b2f2b25af8c48606995798
SHA512

be68a723f4c6165e951e892709dbc1cc89806ca6d4a20c8e8ebd29a640df2a15e5bebed7f3004b0b30ebe0bd71c94b99801003dce6a9289daccee763dd84dac9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 572 wrote to memory of 540	572	rundll32.exe	28
PID 572 wrote to memory of 540	572	rundll32.exe	28
PID 572 wrote to memory of 540	572	rundll32.exe	28
PID 572 wrote to memory of 540	572	rundll32.exe	28
PID 572 wrote to memory of 540	572	rundll32.exe	28
PID 572 wrote to memory of 540	572	rundll32.exe	28
PID 572 wrote to memory of 540	572	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a49ca14194984b58074a837d69f630e7275d082022b2f2b25af8c48606995798.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a49ca14194984b58074a837d69f630e7275d082022b2f2b25af8c48606995798.dll,#1
  2⤵
  PID:540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/540-55-0x0000000075C11000-0x0000000075C13000-memory.dmp

Filesize
8KB

Download