f952ac8308f7e7522b13c4826deeaa8dcc7a1d6a1bd1eced6dd26570112c4d14 | Triage

Analysis

max time kernel
45s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 01:44

Sharing

Report Analysis Logs

General

Target

f952ac8308f7e7522b13c4826deeaa8dcc7a1d6a1bd1eced6dd26570112c4d14.dll
Size

3KB
MD5

c8e18f391cda874e2780eb5a86befc30
SHA1

074cf34610522e57a4a9e13beaee2dcffa1db7d3
SHA256

f952ac8308f7e7522b13c4826deeaa8dcc7a1d6a1bd1eced6dd26570112c4d14
SHA512

f6be9ecfe2d4a3b8d162fecbe3519e1ce221219e4fee54b1adc3aca44f90c183aee47cf07306cb5ef87f47922c1dfa20aa1d84c6f360d10b6881d2d24da53748

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1468	1520	rundll32.exe	28
PID 1520 wrote to memory of 1468	1520	rundll32.exe	28
PID 1520 wrote to memory of 1468	1520	rundll32.exe	28
PID 1520 wrote to memory of 1468	1520	rundll32.exe	28
PID 1520 wrote to memory of 1468	1520	rundll32.exe	28
PID 1520 wrote to memory of 1468	1520	rundll32.exe	28
PID 1520 wrote to memory of 1468	1520	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f952ac8308f7e7522b13c4826deeaa8dcc7a1d6a1bd1eced6dd26570112c4d14.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f952ac8308f7e7522b13c4826deeaa8dcc7a1d6a1bd1eced6dd26570112c4d14.dll,#1
  2⤵
  PID:1468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1468-54-0x0000000000000000-mapping.dmp

Download
memory/1468-55-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download