72f1be157339dbbe392159e35f8de797b088b3a70de3c5bffc631b79708d4a08 | Triage

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 02:18

Sharing

Report Analysis Logs

General

Target

72f1be157339dbbe392159e35f8de797b088b3a70de3c5bffc631b79708d4a08.dll
Size

3KB
MD5

00854ba4b7c028084a794ae63aa74b60
SHA1

cba17a4fb7ac5a795c34d6acc267a774922ba358
SHA256

72f1be157339dbbe392159e35f8de797b088b3a70de3c5bffc631b79708d4a08
SHA512

540862de58bf88362e35e3900d48f960daed33eabce987a6608a0d8fdb2a80149a4a673923858cc939cc0e706dde542e5ddbe82f20b547edba8c71799c6db6d2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 1224	1032	rundll32.exe	28
PID 1032 wrote to memory of 1224	1032	rundll32.exe	28
PID 1032 wrote to memory of 1224	1032	rundll32.exe	28
PID 1032 wrote to memory of 1224	1032	rundll32.exe	28
PID 1032 wrote to memory of 1224	1032	rundll32.exe	28
PID 1032 wrote to memory of 1224	1032	rundll32.exe	28
PID 1032 wrote to memory of 1224	1032	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72f1be157339dbbe392159e35f8de797b088b3a70de3c5bffc631b79708d4a08.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\72f1be157339dbbe392159e35f8de797b088b3a70de3c5bffc631b79708d4a08.dll,#1
  2⤵
  PID:1224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1224-55-0x0000000076711000-0x0000000076713000-memory.dmp

Filesize
8KB

Download