88604d32aa228d0b2c046609d392a99d184b916c62fa476967dce908addf4503 | Triage

Analysis

max time kernel
35s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 21:48

Sharing

Report Analysis Logs

General

Target

88604d32aa228d0b2c046609d392a99d184b916c62fa476967dce908addf4503.dll
Size

3KB
MD5

c2aa256bd41b0fb68b72578a2d5fb537
SHA1

9b3156dbdfbb310c98d613cf5150448fba923400
SHA256

88604d32aa228d0b2c046609d392a99d184b916c62fa476967dce908addf4503
SHA512

0cbcb693abc74c96b2cbcd345ba16eaa91dc16b7a42279826733e8a2bfc43b7dbcf63d46db21ebb18899acaa5a1b75f61f8a730b03f97e869287cf9cb8a24d34

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 2044	1076	rundll32.exe	26
PID 1076 wrote to memory of 2044	1076	rundll32.exe	26
PID 1076 wrote to memory of 2044	1076	rundll32.exe	26
PID 1076 wrote to memory of 2044	1076	rundll32.exe	26
PID 1076 wrote to memory of 2044	1076	rundll32.exe	26
PID 1076 wrote to memory of 2044	1076	rundll32.exe	26
PID 1076 wrote to memory of 2044	1076	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\88604d32aa228d0b2c046609d392a99d184b916c62fa476967dce908addf4503.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\88604d32aa228d0b2c046609d392a99d184b916c62fa476967dce908addf4503.dll,#1
  2⤵
  PID:2044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download