4d178a99bf68e73be56d7620eecf76b3dbd606a74a450e88929915b34d380504 | Triage

Analysis

max time kernel
12s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 23:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4d178a99bf68e73be56d7620eecf76b3dbd606a74a450e88929915b34d380504.dll
Size

3KB
MD5

ef8fd462eea6f574b1820f5660372ae0
SHA1

3e57d0bc9184c2ebc071329322442aa896e3d09a
SHA256

4d178a99bf68e73be56d7620eecf76b3dbd606a74a450e88929915b34d380504
SHA512

18d73ffa388ac900f6490e750f54cd6a74b58e85d36f59501e5e1ae2f06e5a641e776f948c188f4c73662faa61ef9d731d9b61038bee0bfb59160561b19aa486

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1668	1748	rundll32.exe	28
PID 1748 wrote to memory of 1668	1748	rundll32.exe	28
PID 1748 wrote to memory of 1668	1748	rundll32.exe	28
PID 1748 wrote to memory of 1668	1748	rundll32.exe	28
PID 1748 wrote to memory of 1668	1748	rundll32.exe	28
PID 1748 wrote to memory of 1668	1748	rundll32.exe	28
PID 1748 wrote to memory of 1668	1748	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d178a99bf68e73be56d7620eecf76b3dbd606a74a450e88929915b34d380504.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d178a99bf68e73be56d7620eecf76b3dbd606a74a450e88929915b34d380504.dll,#1
  2⤵
  PID:1668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-55-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download