b4c3c63352d7bb9c6b21c61ea982cb3177fd868f1f5b55745c321958675eb50b | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 23:28

Sharing

Report Analysis Logs

General

Target

b4c3c63352d7bb9c6b21c61ea982cb3177fd868f1f5b55745c321958675eb50b.dll
Size

3KB
MD5

56abe087548320eeb2cb602a1d487a00
SHA1

05fd2f67ac41bf29eff5310ed04ba680909b6944
SHA256

b4c3c63352d7bb9c6b21c61ea982cb3177fd868f1f5b55745c321958675eb50b
SHA512

49a3257ff1e9d06fd374c670edfb67e244e16a8696950c60aaf813c369ffdcfb338582ecda887180a91e8d7e33d55c63fb8c74d29d944b7c09c85f54a0de1cbe

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 780	900	rundll32.exe	27
PID 900 wrote to memory of 780	900	rundll32.exe	27
PID 900 wrote to memory of 780	900	rundll32.exe	27
PID 900 wrote to memory of 780	900	rundll32.exe	27
PID 900 wrote to memory of 780	900	rundll32.exe	27
PID 900 wrote to memory of 780	900	rundll32.exe	27
PID 900 wrote to memory of 780	900	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4c3c63352d7bb9c6b21c61ea982cb3177fd868f1f5b55745c321958675eb50b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4c3c63352d7bb9c6b21c61ea982cb3177fd868f1f5b55745c321958675eb50b.dll,#1
  2⤵
  PID:780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/780-55-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download