9f0f26ceb94cd09e731c6a1b11f84d9f69e38477ffe70cbfeed801af8e2b3de8 | Triage

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 21:40

Sharing

Report Analysis Logs

General

Target

9f0f26ceb94cd09e731c6a1b11f84d9f69e38477ffe70cbfeed801af8e2b3de8.dll
Size

3KB
MD5

4540c8cef9c2c4e59221740b0d60d8e0
SHA1

18772d1661ccf8399c41464169b524bd62ed00c7
SHA256

9f0f26ceb94cd09e731c6a1b11f84d9f69e38477ffe70cbfeed801af8e2b3de8
SHA512

6dcda146556ae7943ec71ba4ead7fd43b9fb0efe10e95bc4b32c1e6c8b826fdd23ee9ccf89e849c43f06d50a6a820cbcbd5cc34a552908bbf92b3f5e9b99e14f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2016	1672	rundll32.exe	27
PID 1672 wrote to memory of 2016	1672	rundll32.exe	27
PID 1672 wrote to memory of 2016	1672	rundll32.exe	27
PID 1672 wrote to memory of 2016	1672	rundll32.exe	27
PID 1672 wrote to memory of 2016	1672	rundll32.exe	27
PID 1672 wrote to memory of 2016	1672	rundll32.exe	27
PID 1672 wrote to memory of 2016	1672	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f0f26ceb94cd09e731c6a1b11f84d9f69e38477ffe70cbfeed801af8e2b3de8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f0f26ceb94cd09e731c6a1b11f84d9f69e38477ffe70cbfeed801af8e2b3de8.dll,#1
  2⤵
  PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-55-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download