755128cad745935ced867e518c8fa8e967d29bd7268f922b0f7a0499254dc82d | Triage

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 22:54

Sharing

Report Analysis Logs

General

Target

755128cad745935ced867e518c8fa8e967d29bd7268f922b0f7a0499254dc82d.dll
Size

4KB
MD5

906bb47a4ed2ce7c8fe082e8d3ec5c90
SHA1

f055051a5d314c45bf3f11e691d15ed299dc3886
SHA256

755128cad745935ced867e518c8fa8e967d29bd7268f922b0f7a0499254dc82d
SHA512

8d16c2600e06d464a2973b363c3df5fb5cae822ae294006707fb37c5ee5a0fbbb928e73d718dea83f5430ea5eedf163898c769096c310d4d85843c9cb789d77e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1560	1344	rundll32.exe	26
PID 1344 wrote to memory of 1560	1344	rundll32.exe	26
PID 1344 wrote to memory of 1560	1344	rundll32.exe	26
PID 1344 wrote to memory of 1560	1344	rundll32.exe	26
PID 1344 wrote to memory of 1560	1344	rundll32.exe	26
PID 1344 wrote to memory of 1560	1344	rundll32.exe	26
PID 1344 wrote to memory of 1560	1344	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\755128cad745935ced867e518c8fa8e967d29bd7268f922b0f7a0499254dc82d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\755128cad745935ced867e518c8fa8e967d29bd7268f922b0f7a0499254dc82d.dll,#1
  2⤵
  PID:1560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1560-55-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download