674d7851371b0d82dea88185c9d85795d487fbf4338f5e529f2f12a6584ea286 | Triage

Analysis

max time kernel
41s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 23:00

Sharing

Report Analysis Logs

General

Target

674d7851371b0d82dea88185c9d85795d487fbf4338f5e529f2f12a6584ea286.dll
Size

3KB
MD5

5601777517d1889861833c36364eda60
SHA1

3ec33ef2b3ee060baf3f6fe10a2447575bfdc620
SHA256

674d7851371b0d82dea88185c9d85795d487fbf4338f5e529f2f12a6584ea286
SHA512

7b1892f1a224b97bf1801712c142ae6d5691d49ec0a90b79ca0c20b6cc7a6d297d48137d601553c023b3eec24082016e062e3c9472094424d38ae01d682f5c77

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 904	944	rundll32.exe	28
PID 944 wrote to memory of 904	944	rundll32.exe	28
PID 944 wrote to memory of 904	944	rundll32.exe	28
PID 944 wrote to memory of 904	944	rundll32.exe	28
PID 944 wrote to memory of 904	944	rundll32.exe	28
PID 944 wrote to memory of 904	944	rundll32.exe	28
PID 944 wrote to memory of 904	944	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\674d7851371b0d82dea88185c9d85795d487fbf4338f5e529f2f12a6584ea286.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\674d7851371b0d82dea88185c9d85795d487fbf4338f5e529f2f12a6584ea286.dll,#1
  2⤵
  PID:904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/904-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download