817d5e921bce72c1da58d69440658fa73233a4143594b2779025f77a7fff1a72 | Triage

Analysis

max time kernel
55s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 02:14

Sharing

Report Analysis Logs

General

Target

817d5e921bce72c1da58d69440658fa73233a4143594b2779025f77a7fff1a72.dll
Size

3KB
MD5

c71b9f6d70fa355f603f821ae7d9c3a0
SHA1

795c59bb26b395ec4d29f614a6256c47bcc2a8bc
SHA256

817d5e921bce72c1da58d69440658fa73233a4143594b2779025f77a7fff1a72
SHA512

670de076578de311896018a922751081bd4452289a1f95a9a686f16c85df7fbf6ad1091808431956cbc5d756537f6bf26b014a40b3b102b32f70b048d4061ee0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1348	1776	rundll32.exe	28
PID 1776 wrote to memory of 1348	1776	rundll32.exe	28
PID 1776 wrote to memory of 1348	1776	rundll32.exe	28
PID 1776 wrote to memory of 1348	1776	rundll32.exe	28
PID 1776 wrote to memory of 1348	1776	rundll32.exe	28
PID 1776 wrote to memory of 1348	1776	rundll32.exe	28
PID 1776 wrote to memory of 1348	1776	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\817d5e921bce72c1da58d69440658fa73233a4143594b2779025f77a7fff1a72.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\817d5e921bce72c1da58d69440658fa73233a4143594b2779025f77a7fff1a72.dll,#1
  2⤵
  PID:1348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1348-54-0x0000000000000000-mapping.dmp

Download
memory/1348-55-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download