86ec1fcf3539371f7b40c2dbd217d8e0666598a6f647ab7b4c9624edfdb0d482 | Triage

Analysis

max time kernel
33s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 21:48

Sharing

Report Analysis Logs

General

Target

86ec1fcf3539371f7b40c2dbd217d8e0666598a6f647ab7b4c9624edfdb0d482.dll
Size

3KB
MD5

3c52a7e3b6de80cdc850f41d515b752a
SHA1

66df6457fe3d7b17c7b48335252e9fd6e069dc06
SHA256

86ec1fcf3539371f7b40c2dbd217d8e0666598a6f647ab7b4c9624edfdb0d482
SHA512

921bf1117de1342ab04e111d0017bffef9f5fbf21acbb157d04a85972d6b8e5ec8135ee7843c712858e9f0d9e817fa06e86076475ccf3005ee9ca0df6fd8bd3b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 832	576	rundll32.exe	26
PID 576 wrote to memory of 832	576	rundll32.exe	26
PID 576 wrote to memory of 832	576	rundll32.exe	26
PID 576 wrote to memory of 832	576	rundll32.exe	26
PID 576 wrote to memory of 832	576	rundll32.exe	26
PID 576 wrote to memory of 832	576	rundll32.exe	26
PID 576 wrote to memory of 832	576	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\86ec1fcf3539371f7b40c2dbd217d8e0666598a6f647ab7b4c9624edfdb0d482.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\86ec1fcf3539371f7b40c2dbd217d8e0666598a6f647ab7b4c9624edfdb0d482.dll,#1
  2⤵
  PID:832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/832-55-0x0000000075911000-0x0000000075913000-memory.dmp

Filesize
8KB

Download