156d0243354ed0ad3e3ba1246660ab2d1388fb8ff56cec6cb72a2c406b0da706 | Triage

Analysis

max time kernel
9s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 21:59

Sharing

Report Analysis Logs

General

Target

156d0243354ed0ad3e3ba1246660ab2d1388fb8ff56cec6cb72a2c406b0da706.dll
Size

3KB
MD5

8776dc7f05921755f54b698f09fde72e
SHA1

2621c3ea09766c9d312d0bdab9cdb0075f676ec4
SHA256

156d0243354ed0ad3e3ba1246660ab2d1388fb8ff56cec6cb72a2c406b0da706
SHA512

4fabdc84eb2a1419fc7fa3d975c1bf72dca59f624083f698b33458ec8fcfe3c12317b5a46337486dde2d0e927f98834554009179af8649f09180e811020a581e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 360	1660	rundll32.exe	28
PID 1660 wrote to memory of 360	1660	rundll32.exe	28
PID 1660 wrote to memory of 360	1660	rundll32.exe	28
PID 1660 wrote to memory of 360	1660	rundll32.exe	28
PID 1660 wrote to memory of 360	1660	rundll32.exe	28
PID 1660 wrote to memory of 360	1660	rundll32.exe	28
PID 1660 wrote to memory of 360	1660	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\156d0243354ed0ad3e3ba1246660ab2d1388fb8ff56cec6cb72a2c406b0da706.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\156d0243354ed0ad3e3ba1246660ab2d1388fb8ff56cec6cb72a2c406b0da706.dll,#1
  2⤵
  PID:360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/360-55-0x00000000767D1000-0x00000000767D3000-memory.dmp

Filesize
8KB

Download