b6b52e1038d28751a7f1523d331babcf41edc4b0de6a83e1ed847bb0047d3944 | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 22:29

Sharing

Report Analysis Logs

General

Target

b6b52e1038d28751a7f1523d331babcf41edc4b0de6a83e1ed847bb0047d3944.dll
Size

3KB
MD5

9425c046bd77b207bdcd8c2679cfb7b0
SHA1

6e4efb067d828f885b18a49bafd17d1d0e866470
SHA256

b6b52e1038d28751a7f1523d331babcf41edc4b0de6a83e1ed847bb0047d3944
SHA512

d6a789ebe1cbebb9a174f69f42b0e1bc48ab2a1592e33369cc6183273af2eaa789ef30c171f153ad5ae88aa1073e51c45f998ece766515d76162eb213cad1732

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 1628	844	rundll32.exe	28
PID 844 wrote to memory of 1628	844	rundll32.exe	28
PID 844 wrote to memory of 1628	844	rundll32.exe	28
PID 844 wrote to memory of 1628	844	rundll32.exe	28
PID 844 wrote to memory of 1628	844	rundll32.exe	28
PID 844 wrote to memory of 1628	844	rundll32.exe	28
PID 844 wrote to memory of 1628	844	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6b52e1038d28751a7f1523d331babcf41edc4b0de6a83e1ed847bb0047d3944.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6b52e1038d28751a7f1523d331babcf41edc4b0de6a83e1ed847bb0047d3944.dll,#1
  2⤵
  PID:1628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download