1a49f095e9c18f9960bba6156681f45d665044d442ca9723ac26b4bd88997b92 | Triage

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 21:58

Sharing

Report Analysis Logs

General

Target

1a49f095e9c18f9960bba6156681f45d665044d442ca9723ac26b4bd88997b92.dll
Size

3KB
MD5

ffa601678e80bce990e3f2a8a67de230
SHA1

3ce8600aabffbd4f731fba170665507336b3116d
SHA256

1a49f095e9c18f9960bba6156681f45d665044d442ca9723ac26b4bd88997b92
SHA512

0e0ddfc633d478eb4ebaa6b9baeaedd78c33c86b74bc701895f26d78439246fab032c4b547620201090df74334cd68cadae8e2b85ed16f941cd9440bd8fd36e8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a49f095e9c18f9960bba6156681f45d665044d442ca9723ac26b4bd88997b92.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a49f095e9c18f9960bba6156681f45d665044d442ca9723ac26b4bd88997b92.dll,#1
  2⤵
  PID:1396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1396-55-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download