a9e81793d09803c243f93ee0099ab983df4441545aa8b71525f65d412d594047 | Triage

Analysis

max time kernel
36s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 21:46

Sharing

Report Analysis Logs

General

Target

a9e81793d09803c243f93ee0099ab983df4441545aa8b71525f65d412d594047.dll
Size

3KB
MD5

653e06bede8107cdc11c6f0cb81fa897
SHA1

186db5a4aa18f09722be9f56d714b99dacb5b2fc
SHA256

a9e81793d09803c243f93ee0099ab983df4441545aa8b71525f65d412d594047
SHA512

22b72d1a705b159b4545f5c440e5d3826fa9ab276f461897f71f7db79eb6cf4c554db3b4a9fef897084ad9cf8304e8ebfa1517a52aef243cfd0852c197ff5028

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26
PID 2020 wrote to memory of 1472	2020	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9e81793d09803c243f93ee0099ab983df4441545aa8b71525f65d412d594047.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9e81793d09803c243f93ee0099ab983df4441545aa8b71525f65d412d594047.dll,#1
  2⤵
  PID:1472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1472-55-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download