36c322dd2293a99a2783f5b438f147c09cd7bd2f0711ded082efff607530e029 | Triage

Analysis

max time kernel
46s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 23:15

Sharing

Report Analysis Logs

General

Target

36c322dd2293a99a2783f5b438f147c09cd7bd2f0711ded082efff607530e029.dll
Size

3KB
MD5

95675d2aed518e0e8d745cb5806119b0
SHA1

2660bb19e8146a5fec0119bf545d1ee6d54ba351
SHA256

36c322dd2293a99a2783f5b438f147c09cd7bd2f0711ded082efff607530e029
SHA512

4b927af9f1b6e96eda9c56272c46b1c5a47e18d6b15e3a49f9de00ba1f6df50d64e7e487e1282e333335d859852844aca03d2932912d52ec93c1b768e6bc590b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1672	1380	rundll32.exe	23
PID 1380 wrote to memory of 1672	1380	rundll32.exe	23
PID 1380 wrote to memory of 1672	1380	rundll32.exe	23
PID 1380 wrote to memory of 1672	1380	rundll32.exe	23
PID 1380 wrote to memory of 1672	1380	rundll32.exe	23
PID 1380 wrote to memory of 1672	1380	rundll32.exe	23
PID 1380 wrote to memory of 1672	1380	rundll32.exe	23

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36c322dd2293a99a2783f5b438f147c09cd7bd2f0711ded082efff607530e029.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\36c322dd2293a99a2783f5b438f147c09cd7bd2f0711ded082efff607530e029.dll,#1
  2⤵
  PID:1672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-55-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download