7298d798a448ee08b98ba6b6cce47a2ab97fa1eb216d7a99cd75246763a64d3a | Triage

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7298d798a448ee08b98ba6b6cce47a2ab97fa1eb216d7a99cd75246763a64d3a.dll
Size

3KB
MD5

f7af8654489de6e239f2d6a59aba65d0
SHA1

4cee070f0ea698daff1d11b05fb095b5a482e393
SHA256

7298d798a448ee08b98ba6b6cce47a2ab97fa1eb216d7a99cd75246763a64d3a
SHA512

e0bcbcc1290bba05fe13809fd02fcccf22e1c863fb6eb919bd3978e5825904af106db4532fdddbb7250b90fbfcced93028460f89df65a828c1c53d7f6a5d0561

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2036	2012	rundll32.exe	27
PID 2012 wrote to memory of 2036	2012	rundll32.exe	27
PID 2012 wrote to memory of 2036	2012	rundll32.exe	27
PID 2012 wrote to memory of 2036	2012	rundll32.exe	27
PID 2012 wrote to memory of 2036	2012	rundll32.exe	27
PID 2012 wrote to memory of 2036	2012	rundll32.exe	27
PID 2012 wrote to memory of 2036	2012	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7298d798a448ee08b98ba6b6cce47a2ab97fa1eb216d7a99cd75246763a64d3a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7298d798a448ee08b98ba6b6cce47a2ab97fa1eb216d7a99cd75246763a64d3a.dll,#1
  2⤵
  PID:2036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-55-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download