bc2a1f243bcfe0d6b4e006fd7b455a0a8bd5bab00f9cc784cc15960ddc2fe6be | Triage

Analysis

max time kernel
6s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 01:59

Sharing

Report Analysis Logs

General

Target

bc2a1f243bcfe0d6b4e006fd7b455a0a8bd5bab00f9cc784cc15960ddc2fe6be.dll
Size

3KB
MD5

44d5172699387a3ac5b0c7b70e39b660
SHA1

ab77ed2573f2012559b43cee964819691e585bef
SHA256

bc2a1f243bcfe0d6b4e006fd7b455a0a8bd5bab00f9cc784cc15960ddc2fe6be
SHA512

ae4c4f2c46409e5dfc369b8127b2714a394b75c9140a046bbe9772998dfcf9f1b094db8dc970378834338c4b3b1426d2e6fa39b44638dabe020789d4fefee5e3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1632	1628	rundll32.exe	28
PID 1628 wrote to memory of 1632	1628	rundll32.exe	28
PID 1628 wrote to memory of 1632	1628	rundll32.exe	28
PID 1628 wrote to memory of 1632	1628	rundll32.exe	28
PID 1628 wrote to memory of 1632	1628	rundll32.exe	28
PID 1628 wrote to memory of 1632	1628	rundll32.exe	28
PID 1628 wrote to memory of 1632	1628	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc2a1f243bcfe0d6b4e006fd7b455a0a8bd5bab00f9cc784cc15960ddc2fe6be.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc2a1f243bcfe0d6b4e006fd7b455a0a8bd5bab00f9cc784cc15960ddc2fe6be.dll,#1
  2⤵
  PID:1632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1632-54-0x0000000000000000-mapping.dmp

Download
memory/1632-55-0x00000000757B1000-0x00000000757B3000-memory.dmp

Filesize
8KB

Download