1cf04e20b3b332d9fb2d13f815eed548e0b46b7118f26780f271ee5920d8a14c | Triage

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 23:40

Sharing

Report Analysis Logs

General

Target

1cf04e20b3b332d9fb2d13f815eed548e0b46b7118f26780f271ee5920d8a14c.dll
Size

3KB
MD5

c93851c4a4a39b279c1c9ab11582aff0
SHA1

51275815b6328978e1641cb4d6e5267dd200c9f6
SHA256

1cf04e20b3b332d9fb2d13f815eed548e0b46b7118f26780f271ee5920d8a14c
SHA512

22a5bbe3986911fe7e41ff720cbf69f2dab71af757268e57819835c47efe99b54f93705a73125d45a8160d514ec49d9ce17e5b57f20ddb05542636e57ab60c7f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1284	1768	rundll32.exe	27
PID 1768 wrote to memory of 1284	1768	rundll32.exe	27
PID 1768 wrote to memory of 1284	1768	rundll32.exe	27
PID 1768 wrote to memory of 1284	1768	rundll32.exe	27
PID 1768 wrote to memory of 1284	1768	rundll32.exe	27
PID 1768 wrote to memory of 1284	1768	rundll32.exe	27
PID 1768 wrote to memory of 1284	1768	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1cf04e20b3b332d9fb2d13f815eed548e0b46b7118f26780f271ee5920d8a14c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1cf04e20b3b332d9fb2d13f815eed548e0b46b7118f26780f271ee5920d8a14c.dll,#1
  2⤵
  PID:1284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1284-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download