3dd6cfe1c2c32191f5a887f460b90b45b22a378ca17115b7ae9725fed7c0249e | Triage

Analysis

max time kernel
25s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 21:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3dd6cfe1c2c32191f5a887f460b90b45b22a378ca17115b7ae9725fed7c0249e.dll
Size

3KB
MD5

20275cb853737f5ade255791a0db9780
SHA1

3bac64f68bdc0b15fd1ae2a8dfd304295d24302d
SHA256

3dd6cfe1c2c32191f5a887f460b90b45b22a378ca17115b7ae9725fed7c0249e
SHA512

42ef8cf2f934b1a9e57015f751424ece6593c41b2b7f1083e20c0c002f4dd080384b384ce2f4da4634f3117f106a9ee6813bfe3dd76a78bb26b00fea0640bc35

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1084	836	rundll32.exe	27
PID 836 wrote to memory of 1084	836	rundll32.exe	27
PID 836 wrote to memory of 1084	836	rundll32.exe	27
PID 836 wrote to memory of 1084	836	rundll32.exe	27
PID 836 wrote to memory of 1084	836	rundll32.exe	27
PID 836 wrote to memory of 1084	836	rundll32.exe	27
PID 836 wrote to memory of 1084	836	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd6cfe1c2c32191f5a887f460b90b45b22a378ca17115b7ae9725fed7c0249e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd6cfe1c2c32191f5a887f460b90b45b22a378ca17115b7ae9725fed7c0249e.dll,#1
  2⤵
  PID:1084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1084-55-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download