d6ab0424e19245373087929f6e3a4c5f3f3e9eaff9c477a74f8889a3eb660e27 | Triage

Analysis

max time kernel
33s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 21:38

Sharing

Report Analysis Logs

General

Target

d6ab0424e19245373087929f6e3a4c5f3f3e9eaff9c477a74f8889a3eb660e27.dll
Size

3KB
MD5

b60e200066a2e28822cf3f68f0d30600
SHA1

196cbdee6dba9fc47570e73269ecf0f2986d06ca
SHA256

d6ab0424e19245373087929f6e3a4c5f3f3e9eaff9c477a74f8889a3eb660e27
SHA512

84a6015f004b93f92204e9f1c71557e7f826dd50bec855e9d1d6a52110cf2d8c8ed80c856456efa65738744cc634ef2d780d2f52e0674c31be6d269221f28e1d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 956	1928	rundll32.exe	27
PID 1928 wrote to memory of 956	1928	rundll32.exe	27
PID 1928 wrote to memory of 956	1928	rundll32.exe	27
PID 1928 wrote to memory of 956	1928	rundll32.exe	27
PID 1928 wrote to memory of 956	1928	rundll32.exe	27
PID 1928 wrote to memory of 956	1928	rundll32.exe	27
PID 1928 wrote to memory of 956	1928	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6ab0424e19245373087929f6e3a4c5f3f3e9eaff9c477a74f8889a3eb660e27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6ab0424e19245373087929f6e3a4c5f3f3e9eaff9c477a74f8889a3eb660e27.dll,#1
  2⤵
  PID:956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-55-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download