bacee8e0b2badf6d4e7a734621b46f88af786b7b6d27907e8f458cfa34b2c786 | Triage

Analysis

max time kernel
13s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 21:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bacee8e0b2badf6d4e7a734621b46f88af786b7b6d27907e8f458cfa34b2c786.dll
Size

3KB
MD5

8cc6f352cd5d3e7fe6348c85c80b1b64
SHA1

7bfcfd2f21563dee0b41bb388f87edfb016646b0
SHA256

bacee8e0b2badf6d4e7a734621b46f88af786b7b6d27907e8f458cfa34b2c786
SHA512

c7cb46c84963baff99be7b223b42cbdf99b0153903adee32ac1d7faa50c12d104b01afbfd0fb762e9f448305ae8ad4585387830b9e2e18b5b86e0039a2c0667e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 956	1224	rundll32.exe	28
PID 1224 wrote to memory of 956	1224	rundll32.exe	28
PID 1224 wrote to memory of 956	1224	rundll32.exe	28
PID 1224 wrote to memory of 956	1224	rundll32.exe	28
PID 1224 wrote to memory of 956	1224	rundll32.exe	28
PID 1224 wrote to memory of 956	1224	rundll32.exe	28
PID 1224 wrote to memory of 956	1224	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bacee8e0b2badf6d4e7a734621b46f88af786b7b6d27907e8f458cfa34b2c786.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bacee8e0b2badf6d4e7a734621b46f88af786b7b6d27907e8f458cfa34b2c786.dll,#1
  2⤵
  PID:956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download