8f6ee99b47fc5f740c0bd22950280180ed2ace500c9c72a8b7d1ca5aa17a6671 | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 21:40

Sharing

Report Analysis Logs

General

Target

8f6ee99b47fc5f740c0bd22950280180ed2ace500c9c72a8b7d1ca5aa17a6671.dll
Size

3KB
MD5

241da100e2057d547b262b3c2425f200
SHA1

2932d4c1c2998c7b00aeb598e131910bdb793eb1
SHA256

8f6ee99b47fc5f740c0bd22950280180ed2ace500c9c72a8b7d1ca5aa17a6671
SHA512

52562c00fefdd4d8a6f2bbe5dba6b85535e3572f5ffa7c7c58b1dbb25cabebf694e52308e8e22b29d17f54fa40c8f0b9a2c418a0dbe41d43f7dc0e2d421024f6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2004	1948	rundll32.exe	28
PID 1948 wrote to memory of 2004	1948	rundll32.exe	28
PID 1948 wrote to memory of 2004	1948	rundll32.exe	28
PID 1948 wrote to memory of 2004	1948	rundll32.exe	28
PID 1948 wrote to memory of 2004	1948	rundll32.exe	28
PID 1948 wrote to memory of 2004	1948	rundll32.exe	28
PID 1948 wrote to memory of 2004	1948	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f6ee99b47fc5f740c0bd22950280180ed2ace500c9c72a8b7d1ca5aa17a6671.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f6ee99b47fc5f740c0bd22950280180ed2ace500c9c72a8b7d1ca5aa17a6671.dll,#1
  2⤵
  PID:2004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2004-55-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download