fbd60cb4e25c398f0e90a470c0241fc97c6a44c9c8e1103dac7603fcdc12fbf0 | Triage

Analysis

max time kernel
40s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 22:02

Sharing

Report Analysis Logs

General

Target

fbd60cb4e25c398f0e90a470c0241fc97c6a44c9c8e1103dac7603fcdc12fbf0.dll
Size

4KB
MD5

ed5eb8b3fef2369fc47069d1a34bab70
SHA1

38ada6983cb0a728a0179b85ab3db89016d79443
SHA256

fbd60cb4e25c398f0e90a470c0241fc97c6a44c9c8e1103dac7603fcdc12fbf0
SHA512

24d5b0f05d5b8f2afedda2a790b895886c2ea1f41d605a16981617e7d12dd8ad1dd049c5d79659571cfb3656d520021a76bc6a52af00d05bac4e5e6aa98c22f6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1364	2008	rundll32.exe	28
PID 2008 wrote to memory of 1364	2008	rundll32.exe	28
PID 2008 wrote to memory of 1364	2008	rundll32.exe	28
PID 2008 wrote to memory of 1364	2008	rundll32.exe	28
PID 2008 wrote to memory of 1364	2008	rundll32.exe	28
PID 2008 wrote to memory of 1364	2008	rundll32.exe	28
PID 2008 wrote to memory of 1364	2008	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbd60cb4e25c398f0e90a470c0241fc97c6a44c9c8e1103dac7603fcdc12fbf0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbd60cb4e25c398f0e90a470c0241fc97c6a44c9c8e1103dac7603fcdc12fbf0.dll,#1
  2⤵
  PID:1364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1364-55-0x0000000076AE1000-0x0000000076AE3000-memory.dmp

Filesize
8KB

Download