4774af876120608e94f1528063b776ea0d19d2aaa0c8963be79f3722363d2687 | Triage

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 10:56

Sharing

Report Analysis Logs

General

Target

349.dll
Size

600KB
MD5

1e8c4b625a5456a9c1f5db0081848a1f
SHA1

61e310ca58ea6393c36a42e6d7ac550d818b439c
SHA256

2d147dd83ddc3b3662219c204e2a16025f7512d9a1727c0d651dced791226aab
SHA512

11efad410f770c8a3e3e960e039f21b5580670fe7f0c21729c2d8ca28419f7ae5c98ef5c6f8ab4afdc00fdf78d7510bc5d5f3fdf42e2680066632a61dfb80d5b
SSDEEP

12288:QSUUEfo5I6/o2qgkpUdK9Msme0CWUdOWk4F:QSTiWDvLyRme0C0Wk4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1160 wrote to memory of 1892	1160	rundll32.exe	rundll32.exe
PID 1160 wrote to memory of 1892	1160	rundll32.exe	rundll32.exe
PID 1160 wrote to memory of 1892	1160	rundll32.exe	rundll32.exe
PID 1160 wrote to memory of 1892	1160	rundll32.exe	rundll32.exe
PID 1160 wrote to memory of 1892	1160	rundll32.exe	rundll32.exe
PID 1160 wrote to memory of 1892	1160	rundll32.exe	rundll32.exe
PID 1160 wrote to memory of 1892	1160	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\349.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1160

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\349.dll,#1
2⤵
PID:1892

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1892-54-0x0000000000000000-mapping.dmp

Download
memory/1892-55-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download