f2f723c3936cd0bdd593d3ec0d3eb25ad09806f596a27e38b0cb3e33fbaadb79 | Triage

Analysis

max time kernel
27s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 01:45

Sharing

Report Analysis Logs

General

Target

f2f723c3936cd0bdd593d3ec0d3eb25ad09806f596a27e38b0cb3e33fbaadb79.dll
Size

3KB
MD5

a7db5dedc671fe2a6cb5ce58c1185e30
SHA1

dcb88fdd90a4e48bc0e62ca74d18ae9ba1d9e5c8
SHA256

f2f723c3936cd0bdd593d3ec0d3eb25ad09806f596a27e38b0cb3e33fbaadb79
SHA512

8dc651a50efeed44243514c11c62d79a444e1d46a9c3e0ea0242248fd5bdbebc1e1f951fcf6534a5c8b5a32c06e9f360c235717cbe6511ee6c8970584f60a4b4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2032	1968	rundll32.exe	28
PID 1968 wrote to memory of 2032	1968	rundll32.exe	28
PID 1968 wrote to memory of 2032	1968	rundll32.exe	28
PID 1968 wrote to memory of 2032	1968	rundll32.exe	28
PID 1968 wrote to memory of 2032	1968	rundll32.exe	28
PID 1968 wrote to memory of 2032	1968	rundll32.exe	28
PID 1968 wrote to memory of 2032	1968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2f723c3936cd0bdd593d3ec0d3eb25ad09806f596a27e38b0cb3e33fbaadb79.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2f723c3936cd0bdd593d3ec0d3eb25ad09806f596a27e38b0cb3e33fbaadb79.dll,#1
  2⤵
  PID:2032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-55-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download